Aha! I have figured this out -- it's an early ordering initialization problem. Something is querying _r_debug before it is filled in. If I hack the application binary, then I can see that the location in question DOES get initialized later.
Thanks!
Jason
