stumped, the "device" field in auditd mount events on OSX appears to be arbitrary, most of the time they make sense but sometimes they don't. Does anybody have a programmatic method for tracing a "device" used to perform a mount int OSX?