If nstrings is a uint8_t, how can we support 99999 OEM strings?

Why not report an error instead?

Again, why not report malformed input instead of silently ignoring it?

Why not report this case as an error?

Better to use calloc().

template_strings doesn't get freed anywhere.

To me this is clearer as

for (i = 0; template_strings[i].node != NULL; i++)
    ;

Spurious change.

Hmm. Going back over this, the DMTF spec defines the header as:
04h | Count | BYTE | Varies Number of strings
so the uint8_t is correct, and the 99,999 number used later is wrong. It appears qemu allows configuring an arbitrary number of these strings but ultimately truncates the count to an 8 bit value.

I'm going to leave this as-is but change the subsequent checks to 255 instead of 99999.

The memory contains both the "array" of struct smbios_string plus the strings themselves immediately following the structs. calloc() didn't seem like the obvious choice here, but perhaps I'm missing something?