This was writing a null one space to the right, outside of the malloc'd buffer. On further review this uses apr_vsnprintf which always returns null terminated.

src/switch_utils.c

@@ -174,8 +174,6 @@ SWITCH_DECLARE(char *) switch_find_parameter(const char *str, const char *param,
 				r = malloc(mlen);
 			}
 
-			*(r + mlen) = '\0';
-
 			switch_snprintf(r, mlen, "%s", ptr);
 
 			break;