Do we need the explicit cleanup here? Isn't it going to be called via the atexit?

It looks like this was always missing, right?

Standard macro constant for maximum unsigned 32-bit quantity.

Unnecessary, use UINT32_MAX from <stdint.h> instead.

Should be:
if (sb.st_size > UINT32_MAX)

Should be:
if (errno || !*arg || *s || x > UINT32_MAX)

Space-tab issues.

Unnecessary space before tab.

Same (+next line).

Ship It!

Unnecessary format string variables.

I think these variables (binfo, cinfo, oinfo) unnecessary, because these format strings used only once (and far away).

Could be:
    printf("kernel: ver=%u.%02u size=%x load=%x entry=%x map=%uM "
        "pgctl=%x:%x\n", btx.btx_majver, btx.btx_minver, btx.btx_textsz,
        BTX_ORIGIN(btx), BTX_ENTRY(btx),
        BTX_MAPPED(btx) * BTX_PGSIZE / 0x100000,
        !!(btx.btx_flags & BTX_MAPONE),
        BTX_MAPPED(btx) - btx.btx_pgctl -
        BTX_PGBASE / BTX_PGSIZE - BTX_MAPPED(btx) * 4 / BTX_PGSIZE);
    printf("client: fmt=%s size=%x text=%x data=%x bss=%x entry=%x\n",
        fmtlist[ihdr.fmt], ihdr.size, ihdr.text, ihdr.data, ihdr.bss,
        ihdr.entry);
    printf("output: fmt=%s size=%x text=%x data=%x org=%x entry=%x\n",
        fmtlist[ohdr.fmt], ohdr.size, ohdr.text, ohdr.data, ohdr.org,
        ohdr.entry);

This expression could be a good candidate for an another function-like macro:
BTX_MAPPED(btx) - btx.btx_pgctl - BTX_PGBASE / BTX_PGSIZE - BTX_MAPPED(btx) * 4 / BTX_PGSIZE

Nested ternary conditional operator (c-style issue), could be:
    switch (i) {
        case I_LDR:
            fname = lname; 
            break;
        case I_BTX:
            fname = bname;
            break;
        default:
            fname = iname;
            break;
    }

Ship It!