SYSCALL instruction fails to list r11 as a destination
DR's decoder only lists rcx as a destination for SYSCALL, while in fact it clobbers r11 to store the flags:
{OP_syscall, 0x0f0510, "syscall", xcx, xx, xx, xx, xx, no, x, NA}, /* AMD/x64 only */
Similarly, SYSRET does not list r11 as a source, nor rcx for that matter:
{OP_sysret, 0x0f0710, "sysret", xx, xx, xx, xx, xx, no, x, NA}, /* AMD/x64 only */