It gets worse: the use of xstrdup below is in fact a leak.  RlistAppendScalarIdemp() delegates to RlistAppendScalar(), when actually appending, which makes a copy (and, when not appending, obvously no-one else is taking ownership of the pointer passed).  So please drop the xstrdup().
Unless there's a compelling reason to truncate (check with @sigurdteigen whether Rlist can cope with long string entries these days), just use found and don't bother truncating (that's all the copy really does) into a buffer here !