Ok, I tore myself away from American Idol and spent some time on this.
I can also confirm the problem Steve reported on a vanilla 2.6.10
kernel. I then added Chris's changes to the same kernel -- seems to
work properly now -- I've already fixed the auditfs piece to use
NETLINK_CB(skb).pid. That'll be in patch #5, update 2.
--
Timothy R. Chavez