From PR:

In fdformat.c a closing parenthesis is at the wrong place.  Instead of
adding sizeof _PATH_DEV + 1 to the length of argv[optind], the length of the
string starting (sizeof _PATH_DEV + 1) characters after argv[optind]'s
beginning (accessing junk memory if we jump over the terminating null
character) is passed to malloc().

PR:		bin/60026
Submitted by:	Stefan Farfeleder <stefan@fafoe.narf.at>

usr.sbin/fdformat/fdformat.c

@@ -205,7 +205,7 @@ main(int argc, char **argv)
 
 	if (stat(argv[optind], &sb) == -1 && errno == ENOENT) {
 		/* try prepending _PATH_DEV */
-		device = malloc(strlen(argv[optind] + sizeof _PATH_DEV + 1));
+		device = malloc(strlen(argv[optind]) + sizeof(_PATH_DEV) + 1);
 		if (device == 0)
 			errx(EX_UNAVAILABLE, "out of memory");
 		strcpy(device, _PATH_DEV);