In curstat_search() (src/cursor/cur_stat.c) there is a typo.
The F_CLR call on the failure path uses WT_CURSTD_VALUE_SET twice instead of WT_CURSTD_KEY_SET | WT_CURSTD_VALUE_SET.
F_CLR(cursor, WT_CURSTD_VALUE_SET | WT_CURSTD_VALUE_SET); // VALUE_SET OR'd with itself