This fixes the syscall path so it no longer clobbers %r9, which means
we can use it as the 6th function argument, following the AMD64 ABI.
We still need a scratch register, but we now get that by stashing away
%rax (the syscall number) in a per-CPU variable, making it available
for use.