|  Ok, one more round, then.

  Cool.

|  +char *
|  +printescaped(const char *src)
|  +{
| [..]
|  +	} else
|  +		 return strdup(src);
|   }

  You'll return NULL if no memory available, which will be dereferenced
on return. I guess you could just err("out of memory") or something if
things get that dire.

|  -			errx(1, "%s: %s", p->fts_path, strerror(p->fts_errno));
|  +			errx(1, "%s: %s", printescaped(p->fts_path),
|  +			    strerror(p->fts_errno));
|   			/* NOTREACHED */

  Missed to free that one?

|  -		(void)fprintf(stderr, "override %s%s%s/%s for %s? ",
|  +		fn =3D  printescaped(path);
|  +		(void)fprintf(stderr, "override %s%s%s/%s for '%s'? ",
|   		    modep + 1, modep[9] =3D=3D ' ' ? "" : " ",
|   		    user_from_uid(sp->st_uid, 0),
|  -		    group_from_gid(sp->st_gid, 0), path);
|  +		    group_from_gid(sp->st_gid, 0), fn);

  Missing free() here too.

  Otherwise looks ok to me.

	mjl