AUDIT_MAX_FIELDS
__u32 fields[AUDIT_MAX_FIELDS];
__u32 values[AUDIT_MAX_FIELDS];
__u32 fieldflags[AUDIT_MAX_FIELDS];
if (rule->field_count > AUDIT_MAX_FIELDS)