This was writing a null one space to the right, outside of the malloc'd buffer. On further review this uses apr_vsnprintf which always returns null terminated.
read() does not NULL terminate statbuf, but strstr expects statbuf to be null terminated.
Minor typo. User is being passed into this fuction as a long pointer, not a long.