AUDIT: expand audit tmp buffer as needed