audit: catch possible NULL audit buffers