It turns out there was a subtle bug in Craig Kulesa's port of
the rmap patch to 2.5, which is only apparent on non-x86 machines
where pfn 0 isn't valid.

The problem was that zap_pte_range() would clear the pte before
page_remove_rmap() would get called. This means that on these
machines the pte chain would never be removed and the machine
would oops at page_alloc.c line 98...

Thanks to Russell King for helping track down this bug.