Can you try this patch? rmind: can you *please* run the tests before commiting such changes? That would have immediately caught this.
Martin
Index: nvlist.c =================================================================== RCS file: /cvsroot/src/sys/external/bsd/libnv/dist/nvlist.c,v retrieving revision 1.7 diff -u -p -r1.7 nvlist.c --- nvlist.c 12 Feb 2019 12:49:23 -0000 1.7 +++ nvlist.c 14 Feb 2019 10:49:59 -0000 @@ -263,7 +263,7 @@ nvlist_set_array_next(nvlist_t *nvl, nvp nvl->nvl_flags |= NV_FLAG_IN_ARRAY; } else { nvl->nvl_flags &= ~NV_FLAG_IN_ARRAY; - nv_free(nvl->nvl_array_next); + nvpair_free_structure(nvl->nvl_array_next); } nvl->nvl_array_next = ele;