Offsets starting from field "Security descriptor data offset" in table "12.3. Security descriptor ($SDS) data stream" are incorrect. There should not be a jump from previous field at offset 4 and size 4 to offset 12, it should be 8.
New Technologies File System (NTFS)
The code in method consist_sds of ntfssecaudit uses the correct offsets.
Also, everywhere in the file, the security descriptor data offset used is 20 instead of 24 in documentation.