why negative error here?

why not return the error instead?

Note that style(9) also really wants you to declare all the variables within a block up front.

A TAILQ is fine. If the logic is simpler, a growable array of pointers might be the other option to consider as then checking for a conflict is simpler I think. In the iteration case you just have to skip NULL pointers in the array.

Have you considered using open_memstream() to construct this string? It will do all the realloc + NUL terminate for you letting you do something like:

struct boot_device *device;
FILE *fp;
char *bootorder;
size_t bootorder_len;

if (TAILQ_EMPTY(&boot_devices))
    return (0);

fp = open_memstream(&fp, &bootorder_len);
TAILQ_FOREACH(device, &boot_devices, boot_device_chain) {
    fwrite(fp, "/pci@i0cf8/pci@%d,%d\n", device->pdi->pdi_slot,
        device->pdi->pdi_func);
}
fclose(cp);

return (qemu_fwcfg_add_file("bootorder", bootorder_len, bootorder));

The comment mostly duplicates the function name so you can probably omit it.