audit_expand
avail = audit_expand(ab, AUDIT_BUFSIZ);
avail = audit_expand(ab,
avail = audit_expand(ab, new_len);