I've figured out why the patched exec server didn't work with mmap, and just opened a bug on it, with a fix attached.
So now I've got a working, mmap-less exec server that burns a lot of extra RAM (each process gets its own private copy of the C library), but lets me execute files across a netmsg TCP/IP session.
I think the next logical step is to get it to attempt an mmap, and only fall back if that doesn't work.