I noticed the au1xxx ethernet driver has a malloc where the return value isn't checked. I did some more looking while waiting for a slow flash programmer and at least these files seem to do the same thing:
./drivers/ns8382x.c ./drivers/bcm570x.c ./drivers/rtl8139.c ./drivers/eepro100.c ./drivers/dc2114x.c ./drivers/e1000.c ./drivers/sk98lin/skge.c ./drivers/cfb_console.c ./drivers/natsemi.c ./drivers/inca-ip_sw.c ./drivers/rtl8169.c ./drivers/pcnet.c ./cpu/mips/au1x00_eth.c ./cpu/ppc4xx/serial.c ./cpu/ppc4xx/405gp_enet.c ./cpu/ppc4xx/440gx_enet.c ./cpu/i386/serial.c ./cpu/mpc8xx/scc.c ./common/hush.c ./cpu/mpc8xx/spi.c ?maybe ./cpu/mpc8260/spi.c ?maybe ./cpu/mpc85xx/ether_fcc.c ./cpu/mpc8260/ether_fcc.c ./cpu/mpc5xxx/fec.c ./cpu/mpc8220/fec.c ./tools/easylogo/easylogo.c
I didn't look under the board directory or check all varieties of alloc :-) I will submit patches for the mips stuff hopefully next week.