I suppose the --sysroot argument should have forced the use of the correct arguments. I ktrace'd the link step and discovered that the i386 build reads /lib/libcrypt.so too but the immediately reads version in /usr/src/obj.i386/destdir.i386/lib. Presumably because the linker realize it's not the correct version. The amd64 build, on the other hand, appears happy with the /lib version and skips the /usr/src/obj.amd64/destdir.amd64/lib version. Removing /lib/libcrypt.so "fixes" the problem. This seems like a bug in the build system. I am not 100% clear on how --sysroot is supposed to work. It seems obvious to me that --sysroot should suppress looking in the host fileystem. But it could also be that -L/lib should be -L/usr/src/obj.amd64/destdir.amd64/lib instead - try that and see via ktrace if it skips the host lookup.
Description: PGP signature