While porting OpenSSH 5.2p1, I have discovered a way to reliably panic QNX 4. I can't say for sure what versions of 
system components this issue applies to, but I've successfully caused panics on both 4.24 and 4.25.

The minimum required code, a single call to mmap(), can be seen in my demo (http://gist.github.com/193603), and attached
 to this post.

My searches have not found any documentation regarding this issue, but if I have missed a posting/notice I apologize.