The ones that I have seen are caused by modifying the first push-data opcode in the input script, changing it from a 1-byte push-data opcode to a 3-byte push-data opcode. Since the same amount of data is pushed on to the stack, the script is still valid. It just changes the transaction hash.
Pieter has listed several things that need to be done. Canonical push-data scripts are just one of them. Some of the changes will require changes to all clients in order to implement them (such as fixing malleable signatures).
That said, I did change my node to not relay transactions with non-canonical push-data opcodes. It seems to be rejecting just the bad transactions, so I'm guessing that existing clients are OK with this change.
I'd been under the impression that changing the opcodes would require the privkey.
Would you mind posting your patch? I'd like to update my nodes as well. Would like to think my ~500 connections are worth something. The less well connected nodes that relay these, the more likely that the non-modified tx makes it to miners first.
