Rather than copying out the full audit trigger record, which includes

a queue entry field, just copy out the unsigned int that is the trigger
message.  In practice, auditd always requested sizeof(unsigned int), so
the extra bytes were ignored, but copying them out was not the intent.

MFC after:	1 month

sys/security/audit/audit_trigger.c

@@ -113,7 +113,7 @@ audit_read(struct cdev *dev, struct uio *uio, int ioflag)
 	}
 	mtx_unlock(&audit_trigger_mtx);
 	if (!error) {
-		error = uiomove(ti, sizeof *ti, uio);
+		error = uiomove(&ti->trigger, sizeof(ti->trigger), uio);
 		free(ti, M_AUDITTRIGGER);
 	}
 	return (error);