I managed to get the mouse working.
The Makefile indeed needs the patch, but it is weird that apparently not on linux; maybe NetBSD native xorg is not quite standard?
To get buttons working, for whatever reason with xorg-server 1.18 you need to configure both vboxmouse AND wscons mouse (ws driver).
Apparently vboxmouse handles only movement, so buttons need to come from traditional mouse driver.
As far as I can see nothing has changed in vboxmouse for ages. It has never called xf86PostButtonEvent function. So maybe earlier xorg version configured ws mouse automatically, but with 1.18 you have to do it by hand.