Might as well get this one out of the way....
There's a lot of use of MD5 with mini-salts of 4 bytes. Its one thing
if using MD5 as a PRF, but its another when using it for its security
properties (or lack thereof). See, for example, crypt.c, user.c, and
passwordcheck.c.
varlena.c appears to claim MD5_HASH_LEN is 32 bytes rather than 16
(perhaps its wishful thinking ?).
There does not appear to be a widely used alternative available.