kernel/audit.c: avoid negative sleep durations