Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > At quick glance, I can see the audit logic is based in transaction > objects, so now it counts one single entry for the two elements in one > single transaction. I can look into this to fix this. > > Florian, are you seing any other issues apart for this miscount? Yes, crash when bisecting (its "fixed" by later patch, hunk must be moved to earlier patch), nft_trans_elems_activate must emit notify also for update case. Maybe more. Just remove these patches.