As the comment says, close() frees the variable, record. So we obtain

the length by evaluating the value from the copy, cbuf instead.  This
fixes a crash caused by previous commit (use-after-free)

Submitted by:	Dimitry Andric <dimitry andric com>
Pointy hat to:	delphij

lib/libc/gen/getcap.c

@@ -260,7 +260,7 @@ getent(char **cap, u_int *len, char **db_array, int fd, const char *name,
 					errno = ENOMEM;
 					return (-2);
 				}
-				*len = strlen(record);
+				*len = strlen(cbuf);
 				*cap = cbuf;
 				return (retval);
 			} else {