Sorry mike -- I'm always afraid to click on a button without knowing what it does. I misunderstood what you were saying earlier about the use of it.
Because the False Positive button simply sends everything with no further input, I was afriad to go anywhere near the false negative button. I still am, to be honest!
I'm fascinated with this Bus error v segfault difference. Bottom line is that I get bus errors under the same circumstances that I used to get segfaults (and glibc errors), i.e. if I enable "too many" mod_sec rules, I'll get bus errors. The more rules I enable, the more bus errors I get. This change happened about a year ago after a kernel update. I posted about it here: viewtopic.php?f=1&t=4538
This whole thing may just be a peculiarity of Virtuozzo/OpenVZ, however.
Just a reminder - we know it isn't mod_sec or the actual rules that's the root cause. Segfaults were narrowed down to be a problem with apr, I think? But in our case the segfaults/bus errors are most likely some wierd combination or interaction between VZ, php, apache, apr, and for all I know Zend Accelerator/Ioncobe/Suhosin, or more specifically the versions of those that we happen to run, plus some badly written/buggy php/cgi script or other being run either by us or by one of our customers.
And as we can't run mod_whatkilledme or similar tools, I guess we'll never know