have a look at the new malloc.c in cvs. it uses mmap.
(the kernel has since changed to account mmap as part of your data
limit, but not in 3.7)