I'm getting a strange core dump from tail

(gdb) file /usr/bin/tail
Reading symbols from /usr/bin/tail...done.
(gdb) core tail.core
Core was generated by `tail'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/libexec/ld.elf_so...done.
Reading symbols from /usr/lib/libc.so.12...done.
#0  0x8049492 in rlines (fp=0x480f09a0, off=10, sbp=0xbfbfd7f8)
    at forward.c:272
272                     if (*--p == '\n' && !--off) {
(gdb) bt
#0  0x8049492 in rlines (fp=0x480f09a0, off=10, sbp=0xbfbfd7f8)
    at forward.c:272
#1  0x80490fd in forward (fp=0x480f09a0, style=RLINES, off=10, sbp=0xbfbfd7f8)
    at forward.c:165
#2  0x804a961 in main (argc=1, argv=0xbfbfd8a8) at tail.c:187
#3  0x8048ba5 in ___start ()
(gdb) print p
$1 = 0x48140035 <Address 0x48140035 out of bounds>

I've have core dumps from other binaries using mmap for no apparent
reason. What's the best thing to do to debug this?

Nick
-- 
aka skrll@netbsd.org, skrll@excite.co.uk