FreeBSD's MALLOC_OPTIONS must be set before any malloc() call.
The bug has been introduced in r3799.

src/core/nginx.c

diff --git a/src/core/nginx.c b/src/core/nginx.c
index b8bab37..3a413e8 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -203,6 +203,10 @@
     ngx_cycle_t      *cycle, init_cycle;
     ngx_core_conf_t  *ccf;
 
+#if (NGX_FREEBSD)
+    ngx_debug_init();
+#endif
+
     if (ngx_strerror_init() != NGX_OK) {
         return 1;
     }
@@ -260,10 +264,6 @@
         }
     }
 
-#if (NGX_FREEBSD)
-    ngx_debug_init();
-#endif
-
     /* TODO */ ngx_max_sockets = -1;
 
     ngx_time_init();