Thanks for the bug fix, checked it into the vprobe toolkit.
Apologies for the limited documetation of offat, there should be more thorough vp docs in the next release. These functions are used to fish out the offset of a struct member from the guest. e.g. offatret("sys_getpid") resolves the function address for sys_getpid (using the mapping provided by the vprobe.guestSyms vmx option), looks for the last instruction in the function that did a mov to RAX (where the return value is placed) and returns the offset used in the mov. eg in "movslq 0x108(%rax),%rax" it would return 0x108, this is the offset of the member we're looking for (RAX points to the struct and 0x108 is the offset of the member in that struct). We can then read the value of the member by using getguest and using this offset and the pointer to a struct (eg the current thread pointer). The offat functions work similarly.