Hi, In usr.sbin/lpr/lpr/lpr.c there isn't a break in the case for '#' when there should be. Here's a patch to fix it from writing a pointer where it shouldn't.
Thanks! --- lpr.c 2009-10-29 00:34:48.000000000 -0400 +++ lpr.patched.c 2013-02-14 17:46:28.364251608 -0500 @@ -150,6 +150,7 @@ if (i > 0) ncopies = i; } + break; case '4': /* troff fonts */ case '3':