Just another thought... a even more decent solution would actually be checking the http header size and parsing only that size and then drop the connection.
This would be DoS proof, agree?
But it would need heavy hacking into the code of ns_getform, I assume, any comments?
