audit_new
td->td_ar = audit_new(event, td);
ar = audit_new(AUE_CORE, td);
struct kaudit_record *audit_new(int event, struct thread *td);
td->td_ar = audit_new(AUE_NULL, td);