procmail core dumps, not dropping privs?

We've run into what seems to be a similar problem with procmail and
realloc() on a FreeBSD system, as reported here:

    http://www.xray.mpe.mpg.de/mailing-lists/procmail/1997-10/msg00347.html

And referenced here:

    http://www.netsys.com/bsdi-users/1999-02/0098.html

We're also seeing some other oddities, where if a user calls procmail from
their .forward, procmail core dumps as uid 0:

    Aug 10 20:51:01 granite procmail[60757]: Out of memory as I tried to 
allocate 2068617 bytes
    Aug 10 20:51:01 granite sm-mta[53482]: h79ICZo6021547: SYSERR(root): mailer 
prog died with signal 11
    Aug 10 20:51:01 granite sm-mta[53482]: h79ICZo6021547: to="|IFS=' ' && exec 
/usr/local/bin/procmail -f- || exit 75 #user", ctladdr 
=<user(_at_)sentex(_dot_)ca> (1220/118), delay=1+06:38:26, xdelay=00:01:05, 
mailer=prog, pri=9412382, dsn=4.0.0, stat=Deferred: prog mailer (/bin/sh) 
exited with EX_TEMPFAIL

And the correlating logs:

    Aug 10 20:18:43 granite /kernel: pid 45538 (procmail), uid 0: exited on 
signal 11
    Aug 10 20:19:48 granite /kernel: pid 46002 (procmail), uid 0: exited on 
signal 11
    Aug 10 20:49:55 granite /kernel: pid 60328 (procmail), uid 0: exited on 
signal 11
    Aug 10 20:51:01 granite /kernel: pid 60757 (procmail), uid 0: exited on 
signal 11

The patch from the original post won't apply cleanly anymore (src/pipes.c
doesn't even use lck_MEMORY anymore).

So my question is twofold:

1) Why is procmail crapping out when trying to allocate 2MB of memory?  Our
   lowest datasize limit is at 4MB (datasize and stacksize, memorylocked and
   memoryuse is 10MB, sbsize and vmemoryuse are 64MB).
2) Why is procmail core'ing as root?  Should it not have dropped privs by
   this point, especially if invoked explicitly via .forward?

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail