missing boot environments cause bootadm list-menu to segfault
Somewhere in the process of upgrading my system the GRUB menu.lst was not updated. This left me with a menu file that references datasets which are no longer present and causes bootadm list-menu to segfault.
If you look at the code in the print_menu_nodes function you will see that it walks the list of boot environments looking for a match. if it is unable to find one the be_node variable is left set to NULL. This then leads to a NULL pointer dereference when the be_active_on_boot member is accessed.