Up to and including elfutils-0.137, dwfl_module_build_id appears to return the address just past the buildid hash value, not the first byte. /usr/src/kernels/2.6.25.14-69.fc8-x86_64 [16:52:23] % eu-unstrip -n -K kernel 0xffffffff81000000+0x556aec e9755c9d3e7816ea9d2c8c3fa07fd94a695f0996@0xffffffff81295a64 /usr/lib/debug/lib/mod whereas 0x...5a50 would have been correct.
It would be helpful if the fixed elfutils code provided some autoconfable entity that identifies the presence of the change. Old elfutils is found widely out there, and clients such as systemtap may need to work with them.
This was resolved upstream in 0.138 (maybe there are some Fedora bz#s for it?). It can be in the next rebasing RHEL5 update, whenever an elfutils package update is slotted in.
Considering that we're building systemtap in bundled-elfutils mode for rhel5, and that elfutils proper is unlikely to be rebased, we may just close this as WONTFIX for rhel5.
Fixed in RHEL6.