Coverity: structurally dead code (UNREACHABLE) unreachable: Since the
loop increment is unreachable, the loop body will never execute more
than once.
Make __cursor_fix_next, __cursor_fix_prev match, I left them different
in the last commit.
CID 1129075 (#2 of 2): Copy into fixed size buffer (STRING_OVERFLOW)
2.  fixed_size_dest: You might overrun the 10 byte fixed-size string
"keybuf" by copying "op->key" without checking the length.
CID 1129078 (#3 of 3): Uninitialized scalar variable (UNINIT)
16. uninit_use: Using uninitialized value "total.commit".
Clean out core files and the results of running the program locally.
CID 1129079 (#1 of 1): Uninitialized pointer read (UNINIT)
8. uninit_use: Using uninitialized value "value".

Restructure so we drop core if there's a problem (initialize
key & value to NULL), and we don't read "value" unless it's
been initialized.
ID 1129074 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking "trk" suggests that it may be null, but
it has already been dereferenced on all paths leading to the check.

(Not a bug, but it's not unreasonable to explicitly initialize trk
before calling calloc.)
Don't test for NULL before calling free(), free handles NULL.
Initialize conn to NULL, avoid introducing bugs in the future.
CID 1129022 (#1 of 1): Dead default in switch (DEADCODE)
dead_error_begin: Execution cannot reach this statement "default:".
dead_error_condition: The switch value "r() % 7U" cannot reach the
default case.
CID 1129023 (#1 of 1): Logically dead code (DEADCODE) dead_error_line:
Execution cannot reach this statement "__wt_spin_unlock(session, &...".
CID 1129026 (#1 of 4): Dereference after null check (FORWARD_NULL)
191. var_deref_op: Dereferencing null pointer "cursor".

Coverity is concerned we're testing for cursor == NULL and subsequently
not testing, just indirecting through the cursor handle.  It can't
happen because there's only one case where it's interesting, when
session_op == cnt, and we catch that case by initializing session_op to 0.

Add some additional code just to ensure it can never happen.
Coverity is concerned we might be indirecting through a NULL pointer --
we can't be; compress the code a bit and try and fool Coverity.
The bottom-level event handlers need to handle a NULL session, the
allocation functions that are required to deal with NULL sessions
call macros that eventually call into the error handlers.
CID 1129031 (#1 of 1): Explicit null dereferenced (FORWARD_NULL)
13. var_deref_op: Dereferencing null pointer "list".

If there's no input, we could drop core, list would be NULL.
Paired lines is a mod test, not a divide test -- found by inspection.
typo
CID 1129069 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking "btree" suggests that it may be null,
but it has already been dereferenced on all paths leading to the check.
Totally missed the other use of "child", fix it up.
Don't leak memory on error, cgconfig holds memory that's may not have
been assinged on error.

Don't lose a scratch buffer if __wt_config_subinit() fails.