>recvfrom(3,
"$\0\0\0\2\0\0\0\1\0\0\0\311_\0\0\352\377\377\377|\0\0\0"..., 8476,
This is your problem. 352 is octal for -EINVAL. Your kernel doesn't understand
the netlink message type that the audit-libs is sending. I put audit-libs-0.9.10
into rawhide and it should be available next time its pushed out. If you feel
like building it yourself, you can get it from
people.redhat.com/sgrubb/audit