Description:
------------
A daemon (using PHPCLI) that spawns children using pcntl_fork crashes reproducibly. 

Crashlog suggests pcntl_tick_handler is the culprit, however it could be my doing.  Crashlog output below.  Crash sometimes occurs right away, but never later than 3 minutes after starting daemon.

Other info:
configure: 
./configure \
--prefix=/usr/local/php5 \
--disable-cgi \
--with-openssl=/usr/local/ssl \
--enable-calendar \
--with-libxml-dir=/usr/local \
--with-gd \
--with-jpeg-dir=/usr/local \
--with-png-dir=/usr/local \
--with-zlib-dir=/usr \
--enable-ftp \
--with-ldap \
--with-mcrypt \
--with-mhash \
--with-mysql=/usr/local/mysql \
--with-ncurses \
--with-pgsql=/usr/local/postgres \
--enable-soap \
--enable-sockets \
--with-pear \
--enable-pcntl

Changes to php.ini from ini-dist:
;include_path = ".:/php/includes"
include_path = ".:/usr/local/php5/include/php:/usr/local/php5/lib/php:./includes"

Reproduce code:
---------------
Providing link to the full source, as the source is somewhat complex:

http://quicksilver.montclair.edu/src/ServiceMonitor/

The crash is happening during the loop() method of ServiceCheckRunner:

    public function loop()
    {
        declare(ticks=1);
        pcntl_signal(SIGCHLD, array($this, "sig_child"));
        pcntl_signal(SIGUSR1, array($this, "sig_usr1"));
        pcntl_signal(SIGINT, array($this, "sig_int"));
        pcntl_signal(SIGHUP, array($this, "sig_hup"));
        pcntl_signal(SIGTERM, array($this, "sig_term"));
        
        //while (1) {}
        
        //begin, The Big Loop.
        while(1)
        {
            $now = time();
            
            if (count($this->children) < $this->num_children)
            {
                $service = $this->next();
                if ($now < $service->next_attempt())
                {
                    sleep(1);
                    continue;
                }
                $service->set_next_attempt();
                if ($pid = pcntl_fork())
                {
                    $this->children[$pid] = $service;
                }
                else {
                    pcntl_alarm($service->timeout());
                    exit($service->run());
                }
            }
            
        } // end, The Big Loop.
        
    } // end function loop

Expected result:
----------------
The processes should continue running until a signal is received and handled, or they receive a SIGKILL.

Actual result:
--------------
Daemon crashes every time it is run, with a malloc message and a core dump (which the kernel catches, and formats using CrashReporter).

Console output:
*** malloc[19317]: error for object 0xcbc4d0: Incorrect checksum for freed object - object was probably modified after being freed; break at szone_error


Output from Apple's CrashReporter:
**********

Host Name:      quicksilver.montclair.edu
Date/Time:      2004-07-22 09:44:07 -0400
OS Version:     10.3.4 (Build 7H63)
Report Version: 2

Command: php
Path:    /usr/local/php5/bin/php
Version: ??? (???)
PID:     19660
Thread:  0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x784816ff

Thread 0 Crashed:
0   php 	0x001bb470 pcntl_tick_handler + 0x9c (pcntl.c:668)
1   php 	0x001804b8 zend_llist_apply_with_argument + 0x38 (zend_llist.c:233)
2   php 	0x0015bb78 php_run_ticks + 0x38 (php_ticks.c:71)
3   php 	0x001ae654 zend_ticks_handler + 0x64 (zend_execute.c:4187)
4   php 	0x001a7364 execute + 0x14c (zend_execute.c:1391)
5   php 	0x001aa90c zend_do_fcall_common_helper + 0x350 (zend_execute.c:2729)
6   php 	0x001a7364 execute + 0x14c (zend_execute.c:1391)
7   php 	0x0018952c zend_execute_scripts + 0xfc (zend.c:1062)
8   php 	0x00152148 php_execute_script + 0x270 (main.c:1629)
9   php 	0x001bca70 main + 0xb98 (php_cli.c:944)
10  php 	0x00002380 _start + 0x188 (crt.c:267)
11  php 	0x000021f4 start + 0x30

PPC Thread State:
  srr0: 0x001bb470 srr1: 0x0000f030                vrsave: 0x00000000
    cr: 0x88022224  xer: 0x00000002   lr: 0x001bb478  ctr: 0x0017d7b0
    r0: 0x001bb4b4   r1: 0xbfffea50   r2: 0x00000000   r3: 0x00279720
    r4: 0x104816f7   r5: 0xbfffea90   r6: 0x00cb08e0   r7: 0x00000004
    r8: 0x02045210   r9: 0x00ca2d60  r10: 0x00276250  r11: 0x00276254
   r12: 0x0017d7b0  r13: 0x00275000  r14: 0x00000000  r15: 0x00278e90
   r16: 0x00000008  r17: 0x00259440  r18: 0x002761b8  r19: 0x00000000
   r20: 0x00000000  r21: 0x00ca33d0  r22: 0x00000001  r23: 0x002749f0
   r24: 0x0025a5d4  r25: 0x00000000  r26: 0x00cbce30  r27: 0x0025b3dc
   r28: 0x00274920  r29: 0x00000001  r30: 0x784816f7  r31: 0x001bb3dc

Binary Images Description:
    0x1000 -   0x228fff php 	php
  0x890000 -   0x8aafff libmysqlclient.12.dylib 	/usr/local/mysql/lib/mysql/libmysqlclient.12.dylib
  0x8b9000 -   0x8d3fff libjpeg.62.dylib 	/usr/local/lib/libjpeg.62.dylib
  0xa6d000 -   0xa93fff libmhash.2.dylib 	/usr/local/lib/libmhash.2.dylib
  0xad5000 -   0xaf5fff libmcrypt.4.dylib 	/usr/local/lib/libmcrypt.4.dylib
 0x1808000 -  0x18d0fff libxml2.2.dylib 	/usr/local/lib/libxml2.2.dylib
0x76080000 - 0x76085fff libltdl.3.dylib 	/usr/lib/libltdl.3.dylib
0x81b90000 - 0x81b92fff libpanel.5.dylib 	/usr/lib/libpanel.5.dylib
0x8fe00000 - 0x8fe4ffff dyld 	/usr/lib/dyld
0x90000000 - 0x90122fff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x939d0000 - 0x939d4fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x94000000 - 0x9403cfff com.apple.LDAPFramework 1.3 (37)	/System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x94120000 - 0x9414bfff libncurses.5.dylib 	/usr/lib/libncurses.5.dylib
0x94500000 - 0x9450ffff libsasl2.2.0.1.dylib 	/usr/lib/libsasl2.2.0.1.dylib
0x945b0000 - 0x945b9fff libz.1.dylib 	/usr/lib/libz.1.dylib
0x94610000 - 0x9462afff libresolv.9.dylib 	/usr/lib/libresolv.9.dylib
0x96a20000 - 0x96ae2fff libcrypto.0.9.7.dylib 	/usr/lib/libcrypto.0.9.7.dylib
0x96b40000 - 0x96b6efff libssl.0.9.7.dylib 	/usr/lib/libssl.0.9.7.dylib
0x96cb0000 - 0x96d9efff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib