After Randy suggested taking my question to the IPFilter list, I dug 
around on that list a bit. Cross-referencing back to netbsd.org yielded 
the solution:

# diff /usr/src/sys/netinet/ip_nat.h /usr/src/sys/netinet/ip_nat.h.old
39c39
< # define      NAT_SIZE        2047
---
 > # define      NAT_SIZE        127
42c42
< # define      RDR_SIZE        2047
---
 > # define      RDR_SIZE        127
45c45
< # define      HOSTMAP_SIZE    8191
---
 > # define      HOSTMAP_SIZE    127
48c48
< # define      NAT_TABLE_SZ    16383
---
 > # define      NAT_TABLE_SZ    127
#

I elected not to enable LARGE_NAT since I don't want the ten minute 
mapping limit.

It's interesting to note that the gnutella clients want ~675 
connections during the initial discovery period, and then settle down 
to 100-150.

Thanks to all who responded.