Description of Problem:

rpm database gets corrupted by normal operations
(rpm -i, rpm -e, rpm -U)
`db_dump Packages' will hang, 100% CPU because of a loop

Version-Release number of selected component (if applicable):
rpm-4.0.3-1.04
db31-3.1.17-1

How Reproducible:
The db_dump hang 100% reproducible
As for the database corruption, I don't know, I only have weekly
snapshots of /var/lib/rpm/* and I cannot reconstruct in which order
packages were installed. I  know they are logged in /var/log/rpmpkgs.*
but rpm -i foo.rpm, rpm -i bar.rpm, rpm -e foo.rpm will not show 
foo.rpm in /var/log/rpmpkgs

Steps to Reproduce:
db_dump Packages
will loop in hash/hash_stat.c:85-94
with pgno = 2922, 2923, 2922, 2923 etc.
        for (sp->hash_free = 0, pgno = hcp->hdr->dbmeta.free;
            pgno != PGNO_INVALID;) {
                ++sp->hash_free;

                if ((ret = memp_fget(dbp->mpf, &pgno, 0, &h)) != 0)
                        goto err;

                pgno = h->next_pgno;
                (void)memp_fput(dbp->mpf, h, 0);
        }

Hmm, which makes sense because it started with this message:
error: db3 error(-30998) from db->close: DB_INCOMPLETE: Cache flush was
unable to complete
rpmdb: Overflow page 3401 of invalid type
rpmdb: Non-invalid page 2922 on free list
error: db3 error(-30985) from db->verify: DB_VERIFY_BAD: Database
verification failed

Looks like page 2922 was reused in spite of the warning
that it was invalid  ?

Additional Information:
This has happened with all rpm-4.03 versions
I use the rpm panacea `rm -f /var/lib/rpm/__db*' whenever
I see `Program version X doesn't match environment version Y'
or `Invalid argument'

I use this shell script whenever I get the
`error: db3 error(...)' message
============================================================
#!/bin/sh
RPMDBDIR=/var/lib/rpm
cp -pr $RPMDBDIR $RPMDBDIR.$$
cd $RPMDBDIR
for file in  Basenames Conflictname Dirnames Group \
             Installtid Name Packages Providename \
             Provideversion Requirename \
             Requireversion Triggername
do
 mv $file $file.maybedamaged
 ( db31_dump $file.maybedamaged | db31_load $file ) && rm -f $file.maybedamaged
done
rpm --rebuilddb
=============================================================

Now even *that* failed ..