Created attachment 2722 
Patch

No, passing NULL does not modify the environment.  Regardless, declaring environ like that is not portable.  Is there an actual problem you're trying to solve, or are you just inspecting code and making (incorrect) assumptions about what it does?

Actually, I've tried to run xterm from xfrun and it cannot get some ssh-agent's environment variables & others (it works well if I create a launcher on desktop/panel).  With the patch, it works for the first time.  But after respawning (?!) from dbus service, xfrun clear all environment variables again.  I'm still tracing this bug.

That's because the dbus session bus gets started before ssh-agent does.  Perhaps that should be changed.

Yes, dbus-daemon (messagebus) gets started from init as a service.  I think it must be this way because some other applications may require it before X/XFCE get start.

But these are from /etc/xdg/xfce4/xinitrc (Fedora 12)

  # Use ssh-agent if installed and not already running.  Run it separately
  # so it populates the environment here, so we can clean it up later.
  sshagent=`which ssh-agent`
  kill_sshagent=0
  if test -z "$SSH_AGENT_PID" -a "$sshagent" -a "x$sshagent" != "xno"; then
      eval `$sshagent -s`
      kill_sshagent=1
  fi

  # Use dbus-launch if installed.
  if test x"$DBUS_SESSION_BUS_ADDRESS" = x""; then
      dbuslaunch=`which dbus-launch`
      if test x"$dbuslaunch" != x"" -a x"$dbuslaunch" != x"no"; then
          eval `$dbuslaunch --sh-syntax --exit-with-session`
      fi
  fi

dbus-launch (session) gets started right after ssh-agent already.  But xfrun is respawned from dbus-daemon, it inherits environment of dbus-daemon.  So, all the settings in bash_profile & others (e.g. xinitrc/xinitrc.d) will be missing.

Ah, whoops, I'm running a newer version of xinitrc that launches ssh-agent first (which I suppose I should put back to the old way).

If your shell is doing the right thing, profile/bashrc should be sourced when running xinitrc itself.  Well, at least one of them should, whichever one gets sourced for non-interactive login shells (or maybe that's non-interactive non-login shells).  Up to you to figure out which and put your commands in the right file.

Regardless, there's no problem here with xfrun.