We haven't seen a Savane installation with more than 65536 groups but I would make Savane requiring a recent 2.6 kernel to run the backend with more than 32 groups. While for now, you need pretty big installation to reach that case.

What if, instead, we would make sure the frontend does not allow to create a group with a name that exists on the system already? That would solve part of the issue.
We would no longer have any risk of ruining an existing group.

And, in the end, while groups are still in the database, one can find out whether they were generated by savane or not, with a 2 line perl script calling Savane.pm
Since there are no longer groups destroyed the harsh way (by hand or almost with a DELETE call) but destroyed if their status match D (or something like that, I dont remember) by sv_cleaner, we should never have a group on the system created by Savane still existing while missing in the database.

But I dont remember sv_cleaner calling groupdel (and it wont fit, since sv_cleaner is unlikely to be run from each server providing services based on ssh). So I dont remember how deleted groups are removed from the system.

Something crossed my mind: would that mean that user "svnnobody" would be member of something between 500 and 5000 groups? Ouch, event recompiling the kernel wouldnt do.