For anyone who was wondering, the problem is the return value in bh_entry_hook: with a non-zero value the Kprobes leaves the return address as is, and the kretprobe has no further effect for that particular function instance, from the docs https://docs.kernel.org/trace/kprobes.html