The shvar.c in usermode/shvar.c has:

 s->arena = calloc(buf.st_size, 1);

But expects the result to be \0 terminated, so this should
be buf.st_size + 1. It's probably best to just copy the shvar.c
from initscripts or authconfig in, which has this bug fixed,

(the initscripts/authconfig version is a fair bit different
having been glib-ized, but last time I checked looked generally
identical, and a little better for a few edge cases.)