Using the string-valued option "logfile" in a negated boolean context "!logfile"
results in a segmentation violation. This occurs on Solaris 2.6 and Linux RH 5.2
and 7.0 as well as Tru64 4.0E. It also occurs for "mailerpath".

Here's what dbx reports:

signal Segmentation fault at   [set_default:411 +0x10,0x12000c084]        if
((cur->type & T_PATH) && *val != '/') {
(dbx) w
   406                          "%s: no value specified for `%s' on line %d\n",
Argv[0],
   407                          var, sudolineno);
   408                      return(FALSE);
   409                  }
   410              }
>* 411              if ((cur->type & T_PATH) && *val != '/') {
   412                  (void) fprintf(stderr,
   413                      "%s: values for `%s' must start with a '/'\n",
Argv[0],
   414                      var);
   415                  return(FALSE);
(dbx) where
>  0 set_default(var = 0x140009bc0 = "logfile", val = (nil), op = 0)
["defaults.c":411, 0x12000c084]
   1 yyparse() ["sudo.tab.c":1110, 0x120006048]
   2 main(argc = 0, argv = 0x11ffffb48) ["visudo.c":293, 0x120003ce8]