This begs the obvious question, why isn't this field - i.e., the "s_login"
   field in the per-process session structure - being set to NULL?

why should it be?
   
   On the other hand, I'm willing to listen to arguments that "xdm" should be
   doing the setlogin(), either internally or via an external program; what do
   all you XFree86-using folks think?

[ why be xfree86 specific ? ]

setlogin(2) says:

     Setlogin() sets the login name of the user associated with the current
     session to name. This call is restricted to the super-user, and is nor-
     mally used only when a new session is being created on behalf of the
     named user (for example, at login time, or when a remote shell is in-
     voked).

`xdm' is a used to login to a system.  it should be calling
setlogin().
   
   Anyway, I'm throwing this out because it seems like a bug but maybe I'm
   unaware of some potential side issue with other ramifications.

yup.  it's a bug in xdm.