On line 11 of /etc/init.d/denyhosts, a "--name" parameter needs to be added to start-stop-daemon. It seems this parameter is required for baselayout-2, whereas baselayout-1 didn't really care. Without the parameter, denyhosts will run, but rc-status will report the service as crashed. I'm using app-admin/denyhosts-2.6 and sys-apps/baselayout-2.0.0_alpha1 Thanks!
Oops, I was filing a number of bugs, and put the wrong summary line on this one.
*poke*
fixed in cvs, thanks for reporting, sorry delay.