As I understood it, part of the problem was that they rolled their own memory handling which cached allocations [1].

Otherwise, I imagine system memory protection would have found this much sooner.

[1]: http://article.gmane.org/gmane.os.openbsd.misc/211963