load_audit_module attempts to initialize the GL (dl_rtld_map).l_audit array, but uses the unrelated audit function index cnt for that, not the slot index for the audit module.

      /* Store the pointer.  */
      if (err_str == NULL && largs.result != NULL)
	{
	  newp->fptr[cnt] = largs.result;

	  /* The dynamic linker link map is statically allocated,
	     initialize the data now.  */
	  GL(dl_rtld_map).l_audit[cnt].cookie = (intptr_t) &GL(dl_rtld_map);
	}
      else
	newp->fptr[cnt] = NULL;
      ++cnt;

Found while trying to fix bug 25097, but not actually related to the l_audit zero-length array. I think this is a bug present in the original implementation. It was not introduced in the load_audit_module refactoring.