There's a bug pointed out in Coverity 44261:

schema_truncate.c allocates const char *cfg[2]
calls __wt_open_cursor
calls __wt_clsm_open
calls __wt_config_gets_def
which looks in cfg[2].

There are other places in the system where we allocate fixed-size cfg arrays that have only two elements – do they have the same problem, maybe, will they ever have the same problem, I'm a lot less confident.

Maybe we need a new type which is a config-array type, that is known to have more slots than we'll need?

@michaelcahill, you know the config code best, any thoughts?