Thanks for the insight. I was surprised by EPERM, would have expected ENOSYS as well.
Looks like EPERM is most likely coming out of unknow system call name being filtered-out by snap-seccomp compiler. I'll update snapd to 2.61.1 to avoid chasing fixed bugs and then see if there's something to improve in the compiler.