audit: replace getname()/putname() hacks with reference counters