Yes,  the PIDTYPE_MAX enum is equal  to 4.  Setting 'plen' to 4 seems to work.
So, it seems like a problem with get_array_length.

I will get you the dump/vmlinux files as soon as I can upload it
someplace (yousendit is acting up).
 
 

In the meantime, can you remove the "plen = 4" hack,
and then do the following:

  $ crash -d7 vmlinux-2.6.16.13-xen test.core

At the very end, just prior to the crash session ending, you should
see the gdb request for pid_hash, which should show something
like this:

GDB IN: command: 15 (GNU_GET_SYMBOL_TYPE)
buf: 0
fp: 31d072d8c0 flags: 8  (GNU_RETURN_ON_ERROR)
addr: 0 addr2: 0 count: 0
name: "pid_hash" length: 0 typecode: 0
typename: (null)
target_typename: (null)
target_length: 0 target_typecode: 0 is_typedef: 0 member: "(null)" member_offset: 0
member_length: 0
member_typecode: 0
value: 0 tagname: "(null)" pc: 0
sp: 0 ra: 0 frame: 0 prevsp: 0
prevpc: 0 lastsp: 0 task: 0 debug: 0

GDB OUT: command: 15 (GNU_GET_SYMBOL_TYPE)
buf: 0
fp: 31d072d8c0 flags: 8  (GNU_RETURN_ON_ERROR)
addr: 0 addr2: 0 count: 0
name: "pid_hash" length: 32 typecode: 2
typename: (null)
target_typename: (null)
target_length: 8 target_typecode: 1 is_typedef: 0 member: "(null)" member_offset: 0
member_length: 0
member_typecode: 0
value: 0 tagname: "(null)" pc: 0
sp: 0 ra: 0 frame: 0 prevsp: 0
prevpc: 0 lastsp: 0 task: 0 debug: 0

What do you see when you do that?

Thanks,
  Dave