This seems to be some combination of Xen and the audit subsystem, but
the attached program crashes my machine 100% of the time.
steps to reproduce the crash:
 *  1) compile with gcc -m32
 *  2) start auditd, install any rule (I've only tested syscall
auditing, but any syscall seems to work).
 *     /etc/init.d/auditd start ; auditctl -D ; auditctl -a
exit,always -F arch=64 -S chmod
 *  3) run'n wait (this only loops twice for me before dying)
 *     ./a.out
 *  4) bask in instantaneous kernel oops.
It's running 2.6.38.8 (but I've seen this bug all the way up to
3.5.0-rc7, the latest I've tested). It's a fairly beefy setup, 32G
memory and 6 cpus.
It's a little bit funky in that it's a 64 bit system and a 32 bit
binary, but something about that 64 bit/32 bit mismatch and the fact
that this is not running on bare metal leads to a crash 100% of the
time.
Any one have any idea what's going on?
Cheers,
peter
-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038