DISA-alignment mismatch on audit_rules_login_events_faillock — SSG pass, DISA fail (RHEL 9.2/9.4/9.6/9.8/9.9) #15053

DISA-alignment testing shows a consistent mismatch for audit_rules_login_events_faillock, reproduced across oscap, anaconda, and ansible remediation scenarios.

Result: SSG = pass, DISA = fail
DISA rule ID: SV-258224r1210926_rule
Affected: RHEL 9.2, 9.4, 9.6, 9.8, 9.9 — not 8.10.

Likely related to the audit_rules_sudoers_d and audit_rules_login_events_lastlog mismatches — all three RHEL-9-only audit_rules_* cases may share a common cause (e.g. an audit rule syntax or path expectation that changed for RHEL 9 STIG content). Worth investigating together.