Because it's xmlroff that is segfaulting, I'm reassigning the bug (hope, that's OK). xmlroff should not segfault - less on valid input.