Dave, The 'tinker step 1000' crash is also at the same line in ntp_config.c . I'll note that that code malloc()s a structure and writes to it, returning a pointer to that structure. H