[PATCH] audit: mark expected switch fall-through