Given where it crashes, it isn't garbled, 0xffff0000 is what is being passed.
One possibility is that something on the stack above _fmtdispatch trashed the
stack.  I don't see anything obviously wrong.  We stopped running rarpd when
our last sun went nova.  You might try rebuilding the libraries and rarpd and
see if it still happens.  The line numbers from your acid stack dump are
a bit different than the current source, so you might have some incompatible
changes in there (or acid is guessing badly).

Otherwise, keep digging, bug snprint and see if fmt is 0xffff0000 coming in,
etc.  If it's consistently repeatable, it should be easy to track down just
by marching tests through the code.