It seems to me that the the signal_cleanup function should only be free()'ing the signals on the usedlist, and should not touch the freelist. this is more or less the opposite of what Guenter has done for the Linux/Alpha port.
Assuming no other file writes to the t_signal structures, than it looks to me like a a t_signal is linked to the usedlist when a new one is alloc()'d, and remains linked on this list even if it is put on the freelist by signal_free(). Therefore all the t_signals that have been allocated are on the usedlist. I suggest that the "usedlist" name is a misnomer and be changed to something more like "allocatedList".
Anyhow, making this change definitely gets rid of the crashes caused by free()'ing the same block twice. I don't think there's any memory leaks, but I haven't done exhaustive testing. Hopefully, Miller, you can confirm if this fix is correct.
Larry
-- Larry Troxler -- lt@westnet.com -- Patterson, NY USA --