The code snippet for auditon(2)'s A_{GET/SET}POLICY command confirms whether the user
submitted only the allowed values for A_{SET/GET}POLICY in the following way:

if (udata.au_policy & ~(AUDIT_CNT|AUDIT_AHLT|AUDIT_ARGV|AUDIT_ARGE))
	return (EINVAL);

That is: If a bit other than the 4 mentioned above is submitted, we'll get EINVAL.

However, The negation bit is misplaced for "udata.au_policy64" case:

if (udata.au_policy & (~AUDIT_CNT|AUDIT_AHLT|AUDIT_ARGV|AUDIT_ARGE))
	return (EINVAL);

This returns EINVAL almost everytime. The only occasion when I got a successful invocation
was passing 0 as the flags, which is not recommended if the system already has some of the
flags set.

Note: The issue was noticed when it failed the regression tests for auditon(2) for
A_SETPOLICY flag.

To reproduce the issue, try this piece of code. If your system has any of the flags set,
you'll probably get EINVAL too.

#include <bsm/audit.h>
#include <stdio.h>

void main(){
        uint64_t auditpolicy;
        auditon(A_GETPOLICY, &auditpolicy, sizeof(auditpolicy));
        printf("retrieved policy = %d\n", auditpolicy);
       
        int retval = auditon(A_SETPOLICY, &auditpolicy, sizeof(auditpolicy));
        if (retval < 0)
                perror("setpolicy");
}