[PATCH] return data buffer in audit_list_rules()