Just for reference, I'd like to mention the pstat(2) interface on HP-UX.
It is similar to sysctl() but does not extend itself to networking, etc.
Through their interface, they return structures which are not the same
as those used by the kernel for holding process info, etc.  Notably, the
structures returned do not contain pointers of any sort - information only!
Obviously there are issues here when it comes to getting things out of
crash dumps, but an appropriate library interface can deal with that.
So where am I going...

I'm not sure if I've seen it mentioned already, but maybe ps should be
using a sysctl() which return a block of such sanitized data.  In that
way, it is not nearly as likely that arbitrary changes to proc or user
are likely to effect the interface ps uses.

As far as debugging crash dumps/running kernels goes, if your tools
are't tuned to the particular version in question then you've got to
ask yourself whether you are doing yourself a service or dis-service.

Darren