bpf: improve read-only handling