okay I think I can reliably make it crash / corrupt. the server is an smp 550mhz p3 xeon with 768mb memory. dom0 has 128mb of memory with no swap. dom1 is a backup mail server which might accept an email every few minutes. It also does spam checking. dom2 is just a base debian install just sitting idle.
I have two identical 300mb files of random data (file3 & file4), and a script that repeatedly compares them (call it 'compare'):
while [ 1 = 1 ]
diff file3 file4 && echo okay
cat file3 >/dev/null
I start this running in the background. (the cat is to effectively flush the buffers so that the diff won't fail again on the same corruption)
I also have a little c program to allocate all memory (call it 'exhaust') (unfortunately it's now crashed bad enough that I can't reboot it from home so i'll send the code tomorrow if anyone's interested)
The crash only seems to occur once I start both dom1 and dom2, or at least get dom0 + 1 other running on cpu 0, and then start running 'exhaust' over and over. Issuing a few 'xm list's seems to help speed up the process. Without running 'exhaust' at least once I can't get it to crash.
The crash that's just occured has generated a heap of oops's but most of them are probably caused by corruption and won't tell anything about the original error. i'll have a look and post any that seem interesting.
hope that helps...