xdrrec_create() routine in lib/libc/xdr/xdr_rec.c returns a void. Under low memory condition this routine can bail out early and leave part of the XDR structrure uninitialized. 

The callers : 

clnt_vc_create() in lib/libc/rpc/clnt_vc.c & 
makefd_xprt() in lib/libc/rpc/svc_vc.c

do not check whether failed or not. 

This can lead to segfault when uninitialized pointers are accessed.

This bug exists in FreeBSD 9 as well.

192	        rstrm->in_base = mem_alloc(recvsize);
193	        if (rstrm->in_base == NULL) {
194	                warnx("xdrrec_create: out of memory");
195	                mem_free(rstrm->out_base, sendsize);
196	                mem_free(rstrm, sizeof(RECSTREAM));
197	                return;
198	        }
199	        /*
200	         * now the rest ...
201	         */
202	        xdrs->x_ops = &xdrrec_ops;
203	        xdrs->x_private = rstrm;
204	        rstrm->tcp_handle = tcp_handle;

Fix: 

It has been reported against netbsd as well.

http://mail-index.netbsd.org/netbsd-bugs/2012/08/06/msg029375.html

I can provide a patch if there is an agreement on how it should be fixed.