A processing device includes a processing core, coupled to a memory, to execute a task including a code segment identified as being monitored and a kernel recorder, coupled to the processing core via a core interface. The kernel recorder includes a first filter circuit to responsive to determining that the task being executed enters the code segment, set the kernel recorder to a first mode under which the kernel recorder is to record, in a first record, a plurality of memory addresses accessed by the code segment, and responsive to determining that the execution of the task exits the code segment, set the kernel recorder to a second mode under which the kernel recorder is to detect a write operation to a memory address recorded in the first record and record the memory address in a second record.