When testing whether to enter the audit argument gathering code, rather

than checking whether audit is enabled globally, instead check whether
the current thread has an audit record.  This avoids entering the audit
code to collect argument data if auditing is enabled but the current
system call is not of interest to audit.

MFC after:	1 week
Sponsored by:	Apple, Inc.

sys/security/audit/audit.h

@@ -186,7 +186,7 @@ void	 audit_thread_free(struct thread *td);
  * audit_enabled flag before performing the actual call.
  */
 #define	AUDIT_ARG(op, args...)	do {					\
-	if (audit_enabled)						\
+	if (td->td_ar != NULL)						\
 		audit_arg_ ## op (args);				\
 } while (0)