djbdns/qmail might qualify here.

qmail had LP64 memory corruption bugs.

One ever right? I wouldn't count that as "frequent" - lots of programs in memory-safe languages have more/worse bugs than qmail.

Of course, the existence of one significant not-too-vulnerable C program doesn't really prove a lot either way...

I though Georgi Guninski found several.