audit: kernel generated netlink traffic should have a portid of 0