use hidden visibility rather than protected for syscall internals