bpf: avoid stack copy and use skb ctx for event output