It turns out there was a subtle bug in Craig Kulesa's port of
the rmap patch to 2.5, which is only apparent on non-x86 machines
where pfn 0 isn't valid.
The problem was that zap_pte_range() would clear the pte before
page_remove_rmap() would get called. This means that on these
machines the pte chain would never be removed and the machine
would oops at page_alloc.c line 98...
Thanks to Russell King for helping track down this bug.