[PATCH 10/21] Check syscall audits explicitly to avoid partial matches