On a fully patched FreeBSD 10.3 system with a few jails (also up-to-date), pkg-1.8.7_3 works as expected. After updating to pkg-1.9.1, it is no longer possible to update the vulnerability list with 'pkg audit -F' if this command is issued from a jail. Running it from the host system works as expected. Force-reinstalling pkg-1.8.7_3 fixes the issue.

This is what happens on the host system:
$ uname -a 
FreeBSD BSD-Server.local 10.3-RELEASE-p7 FreeBSD 10.3-RELEASE-p7 #0: Thu Aug 11 18:38:15 UTC 2016     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

$ freebsd-version
10.3-RELEASE-p10

$ pkg -v
1.9.1

$ sudo pkg audit -F
Fetching vuln.xml.bz2: 100%  646 KiB 661.1kB/s    00:01    
0 problem(s) in the installed packages found.

This is what happens within a jail:
# uname -a
FreeBSD Test-web.local 10.3-RELEASE-p7 FreeBSD 10.3-RELEASE-p7 #0: Thu Aug 11 18:38:15 UTC 2016     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

# freebsd-version
10.3-RELEASE-p10

# pkg -v
1.9.1

# pkg audit -F
pkg: http://vuxml.freebsd.org/freebsd/vuln.xml.bz2: No address record
pkg: cannot fetch vulnxml file

# pkg add -f /var/ports/packages/All/pkg-1.8.7_3.txz
[Test-web.local] Installing pkg-1.8.7_3...
package pkg is already installed, forced install
[Test-web.local] Extracting pkg-1.8.7_3: 100%

# pkg -v
1.8.7


# pkg audit -F
[Test-web.local] Fetching vuln.xml.bz2: 100%  646 KiB 661.1kB/s    00:01    
0 problem(s) in the installed packages found.