Two issues in cur_backup.c/__backup_uri().

First, in this code:

/*
 * Handle log targets.  We do not need to go through the
 * schema worker, just call the function to append them.
 * Set log_only only if it is our only URI target.
 */
if (WT_PREFIX_MATCH(uri, "log:")) {
        if (target_list == 0)
                *log_only = 1;
        else
                *log_only = 0;
        WT_ERR(__wt_backup_list_uri_append(
            session, uri, NULL));
} else
        WT_ERR(__wt_schema_worker(session,
            uri, NULL, __wt_backup_list_uri_append, cfg, 0));

I believe we won't correctly handle the case of a log: prefix followed by another target, that is, if log: is the prefix for the first of several targets, we'll set log_only the first time through the loop, and not reset it when we find additional targets.

Second, backup_uri() takes the WT_CURSOR_BACKUP *cp argument, but the only thing it does is set cb->list_next as part of a for loop, it's a pretty strange side-effect, and should probably move elsewhere.