selinux: return early for possible NULL audit buffers