There's a typo in nvt_remove_nvpair which causes the nvlist_add_* functions to ignore the type when removing entries with the given name/type. This can lead to the wrong entry being removed and multiple entries being created with the same type.