the

audit_force_reconfigure

flag crashed some boxes and I’m trying to figure out why

Is this the thing you are trying to debug, or is this in-addition-to?

In general I’m trying to understand all the nuances of the audit system and how osquery interacts with it (all the different buffers, failure scenarios, etc), but yesterday I happened to encounter that specific issue as well.