Honestly, mostly for providing sysadmins a way to shoot themselves into the foot.

Replacing a symlink to a directory with a directory is the other safe mismatch I can easily think of. I added this as an available catchall instead of trying to model all possible mismatches in case the admin does weird things and really wants it. No objection to removing it.

The only type mismatch caused by a FreeBSD installation without user intervention that I am aware of is installing via bsdinstall with ZFS and enabled disk encryption while using GPT (or MBR before geliboot). This creates a second unencrypted bootpool and /boot becomes a symlink into that bootpool. It might be similar for UFS.
Ignoring the type mismatch in mergemaster via i calls rm -rf on the new files that mergemaster compares against, thus removing all files below /boot from the compare list leaving them unupdated.

Since this is conditional on specific bsdinstall selections, I would follow up this patch with an update to bsdinstall that creates /etc/mergemaster.rc when that selection is chosen during installation, instead of providing a default mergemaster.rc that would then also have to be handled by mergemaster to avoid overwriting a user created one.

I can use /usr/bin/stat -f "%R" "${DESTDIR}${COMPFILE#.}" instead of /bin/realpath "${DESTDIR}${COMPFILE#.}", no problem. But since the manpage says the data for these field specifiers does not come directly from struct stat, my guess it that it calls realpath in the background. I also considered it more readable than a stat format string.

Neither stat -L -f %N or stat -L -f %Y give me the absolute path pointed at by a relative symlink, which is required later to check that the symlink does not escape a changed basepath. What am I missing?

$DESTDIR is only set if mergemaster is started with -D /different/basepath, mergemaster uses for example ${DESTDIR}/ or ${DESTDIR}/var/db to refer to / or /var/db if called without a changed base directory.

This line checks if ${DESTDIR} is unset and the user has therefor not changed the basepath, or when ${DESTDIR} is set, then ${SYMLINK_TARGET} must change if ${DESTDIR} prefix is removed. If ${SYMLINK_TARGET} has no prefix that matches ${DESTDIR} and stays the same, then the symlink points outside of the argument provided basepath.

Providing a default mergemaster.rc is indeed inconvenient. However, perhaps we can hard-code /boot as allowed to be a symlink to a directory.

Oh right, you do need ${SYMLINK_TARGET} below. Ignore my comment :)

That's not what it actually does because the quoting is wrong ;)

Good point. Adding it hard coded has the benefit of also transparently handling it for existing installations while being safe on installations that do not have the mismatch.