I don't see a pullup in the changelog for -rnetbsd-3:

http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/openssl/ssl/ssl_lib.c

According to:

http://arkiv.netbsd.se/?ml=openssl-announce&a=2007-10&m=5433522

"Versions Affected
 ------------------

 All releases of 0.9.8 prior to 0.9.8f. All releases of 0.9.7 prior to
 0.9.7m.
"


3-stable seems to have:

$ openssl version
OpenSSL 0.9.7d 17 Mar 2004

We should patch it.  I'm looking into it now.

~BAS