eCryptfs: track header bytes rather than extents