Index: /trunk/src/auditd-event.c
===================================================================
--- /trunk/src/auditd-event.c	(revision 1420)
+++ /trunk/src/auditd-event.c	(revision 1421)
@@ -444,5 +444,8 @@
 void cleanup_event(struct auditd_event *e)
 {
-	free((void *)e->reply.message);
+	// Over in send_audit_event we sometimes have message pointing
+	// into the middle of the reply allocation. Check for it.
+	if (e->reply.message != e->reply.msg.data)
+		free((void *)e->reply.message);
 	free(e);
 }