merge-recursive: use xstrdup() instead of fixed buffer