I virtualized that crap a couple weeks later.

It's only once the C classic of optimising through FUN™ with pointers, and then weird issues with bits of the Mac ROM not liking being mapped into random high memory addresses that we end up with lockups.

  After  the  stack  address  has  been  selected,  the  process 
  heaps are selected.  Each heap is allocated from a range of 
  32  different  locations,  each  separated  by  64kB.    The 
  location  of  the  first  heap  must  be  chosen  to  avoid  the 
  previously placed stack, and each of the following heaps 
  must be allocated to avoid those allocated before it.

  An important result of Vista’s ASLR design is that some 
  address  space  layout  parameters  such  as  PEB,  stack  and 
  heap  locations  are  selected  once  per  program  execution. 
  Other parameters, such as the location of the program code, 
  data  segment,  BSS  segment  and  libraries,  change  only 
  between reboots.

  This paper shows that the stack, heap, image and PEB 
  protected  by  ASLR  on  Microsoft  Windows  Vista  32bit 
  RTM have different frequency distributions. While the stack 
  has near uniform distribution over a very wide range, the 
  heap and PEB, and to a lesser degree the image base have 
  much  smaller  ranges  and  because  of  biases  in  their 
  distributions do not efficiently use this range.  As a result, 
  the protection offered by ASLR under Windows Vista may 
  not be as robust as expected.