When running Warcraft 3 on my rv280, I can fairly easily reproduce a lockup of
the X server. A backtrace I got when I sshed in looks roughly like:

__GI___ioctl+0x14 in libc.so.6
r200WaitIrq+0x1e (...) ./r200_ioctl.c:375 in r200_dri.so
r200Finish+0x99 (...) ./r200_ioctl.c:846 in r200_dri.so
_mesa_Finish+0x61 main/context.c:1870 in r200_dri.so
wine_glFinish+0x24 dlls/opengl32/opengl_norm.c:1089 in opengl32
...

The code it's looping in (r200_ioctl.c:375):
   do {
      ret = drmCommandWrite( rmesa->dri.fd, DRM_RADEON_IRQ_WAIT,
                             &rmesa->iw, sizeof(rmesa->iw) );
   } while (ret && (errno == EINTR || errno == EBUSY));

drmCommandWrite is calling out an ioctl, and it's obviously not completing the
operation. I can peek at what's in rmesa, but I don't know anything about it. :)
 I'm putting this up for more ideas while I study how to hack the code.

BTW, my xorg.conf options:
Option "EnablePageFlip" "on"
Option "AGPmode" "8"