> On -current i386 with /usr/lib complied with -g, I see:

It looks like mbrtowc() returns strange value.

enami.

% gdb a.out a.out.core
GNU gdb 5.3nb1
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386--netbsdelf"...
Core was generated by `a.out'.
Program terminated with signal 10, Bus error.
Reading symbols from /usr/libexec/ld.elf_so...done.
Loaded symbols for /usr/libexec/ld.elf_so
Reading symbols from /usr/lib/libc.so.12...done.
Loaded symbols for /usr/lib/libc.so.12
Reading symbols from /usr/lib/i18n/libEUCTW.so.4.3...done.
Loaded symbols for /usr/lib/i18n/libEUCTW.so.4.3
#0  0x08048e24 in vfprintf_unlocked (fp=0x9fbff150, 
    fmt0=0x9dbcce58 "%s/%s/%s", ap=0x9fbff1dc "=μ\235\200¼¾\235\006μ\235 ")
    at vfprintf.c:371
371     rflag:          ch = *fmt++;
(gdb) p fmt
$1 = 0xfdfce0b1 <Address 0xfdfce0b1 out of bounds>
(gdb) l vfprintf_unlocked
		:
(gdb) 
338             uio.uio_iov = iovp = iov;
339             uio.uio_resid = 0;
340             uio.uio_iovcnt = 0;
341             ret = 0;
342     
343             memset(&ps, 0, sizeof(ps));
344     
345             /*
346              * Scan the format for conversions (`%' character).
347              */
(gdb) 
348             for (;;) {
349                     cp = fmt;
350                     while ((n = mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) > 0) {
351                             fmt += n;
352                             if (wc == '%') {
353                                     fmt--;
354                                     break;
355                             }
356                     }
357                     if ((m = fmt - cp) != 0) {
(gdb) p cp
$2 = 0x9dbcce58 "%s/%s/%s"
(gdb) p n
$3 = 1614811737
(gdb) p wc
$4 = 37
(gdb) p fmt - n
$5 = 0x9dbcce58 "%s/%s/%s"
(gdb)