I may be missing some of the context, but I don't see that this memory get free()'d anywhere; is it really worth strdup()'ing these strings?

I think the rest of the loop could be avoided with:

(void)snprintf(p, sizeof(buf) - (p - buf), "%d%s", vl->vers, vl->next ? "," : "");

Would it be more elegant to do this instead:

1. flen = strlen(fieldbuf);
2. cp = &fieldbuf[flen];
3. flen += snprintf(cp, sizeof(fieldbuf) - flen, ...);

Or to remain safer:

1. flen = strlen(fieldbuf);
2. cp = &fieldbuf[flen];
3. (void)snprintf(cp, sizeof(fieldbuf) - flen, ...);
4. flen += strlen(cp);

The objects in this list are already leaked, so I don't think it's a problem to leak some additional strings.

Since we're using asprintf() below, I'd rather be consistent and have them all be heap-allocated.

The first one isn't equivalent, since snprintf() returns the number of characters that it wants to write, not the number of characters it did write.

The second one is a bit neater maybe, but I don't really see why it's safer. Here, I just copied what NetBSD did.

The second one is safer than the first one for the reason you mentioned; it's not safer than what NetBSD did.