vfork -> fork. The child calls execl() which calls malloc(), so

vfork() can't be used.  We could use alloca() in execl() so that
it can be called between vfork() and execve(), but a "portable"
popen() shouldn't depend on this.  Calling execle() instead of
execl() should be fairly safe, since execle() is supposed to be
callable from signal handlers and signal handlers can't call
malloc().  However, execle() is broken.

lib/libc/gen/popen.c

@@ -84,7 +84,7 @@ popen(command, type)
 		return (NULL);
 	}
 
-	switch (pid = vfork()) {
+	switch (pid = fork()) {
 	case -1:			/* Error. */
 		(void)close(pdes[0]);
 		(void)close(pdes[1]);