I wonder if it makes sense to set vm.mmap_min_addr to 4096 (instead of 0) for lenny. It seems to me that unstable already made this switch, and given the apparently neverending sequence of kernel NULL dereferences, this might be quite helpful.