Actually, setting /proc/sys/kernel/randomize_va_space to 0 makes this worse because it forces the brk (heap) area to immediately follow the text area, and the NX emulation patch performs randomization of exec regions no matter what randomize_va_space is. It seems the solution here is to fix up the brk starting position to be outside the area used for exec regions.
Actually, setting /proc/sys/ kernel/ randomize_ va_space to 0 makes this worse because it forces the brk (heap) area to immediately follow the text area, and the NX emulation patch performs randomization of exec regions no matter what randomize_va_space is. It seems the solution here is to fix up the brk starting position to be outside the area used for exec regions.