auditme
if ((tad->tad_flag = auditme(kctx, tad, estate)) == 0)
int auditme(au_kcontext_t *, struct t_audit_data *, au_state_t);
if ((tad->tad_flag = auditme(kctx, tad,