| i don't think this is the correct answer.  the tarballs that are failing
   | to extract are netbsd sets.  afaik, those all have files that start with
   | "./" in them.  to me this implies that whatever tests you have added for
   | checking extraction has not changed location are broken in the precense

presence, of course :-)

   | of the --chroot flag.
   | 
   | surely you aren't suggesting that sysinst needs to pass --insecure?
   
   I thought that they start with / not ./ reading from the output of tar.
   Are you sure that they start with ./?

pretty sure.  otherwise extracting them into a NFS client root dir
would be dangerous.  and, sure enough, the sparc world i built a
few days ago tells me:

	splode sparc/binary/sets> foreach a ( *.tgz )
	foreach? pax -z < $a | grep -v '^\./|^\.$'
	foreach? end
	splode sparc/binary/sets> 

ie, no files that are not "." or don't start with "./".