(something I just managed to remember) is that if you call the shell
without STDERR=2, then the shell has no place to send STDERR. The
only way to get this correct is to use POSIX::dup2 instead of the
standard perl open function. Well, I bet there is a way (or 10 ways)
to do this, but this is one that stumbled onto. libaudit does a lot
of descriptor messing around.

BTW; this is also why we sometimes lose STDERR from the XMLRPC server.