> Actually, I was thinking it belongs in ip_output.c, with a switch 
> (-proto3?) that could be set per route to cap the TCP MSS at the MTU for 
> that route (or interface if there is no MTU for the route) for sessions 
> initiated external to the NetBSD box.

I have some (more philosophical) problems with MSS clamping per se, but since
it seems to be usefull for some people (and provided it's optional and off
by default) I can cope ;-)

Anyway, please publish this code (cleaned up or not) and run this through
the tech-net@netbsd.org mailing list!

Martin