I have just updated my netbsd-4 machine to the latest code, after the
pullup of ipsec-tools to the 0.7 branch (ticket #830).  I
built/installed racoon and started it up and it is working just fine.

So, I think we simply have a regression of racoon in -current, and
netbsd-4 seems fine.

Thanks for the pointers and explanation - I'll see if I can figure out
what's going on.