Here's the info from the whois:

Domain Name: [not disclosed]
Domain Status: registrar-lock
Creation Date: 1995-12-10 00:00:00.0
Expiration Date: 2006-12-10 00:00:00.0
Domain Maintainer: [not disclosed]

So if this domain expired over 18 months ago, how can I buy it? How can the registrar just sit on it for that long?

From which whois server did you got this information? Maybe you query a registrars whois server which didn't updated his information.
Go to http://registrar.verisign-grs.com/whois/ in case of a .com or .net domain to get the real data.

That was it, thanks. I was using whois-dot-net, which listed incorrect information. It doesn't expire until 12/08. On down the list, I guess.