postfix 2.5.1 breaks with tls

[Greg Troxel <gdt%ir.bbn.com@localhost>]

I updated to postfix 2.5.1 from 2.4.6 (by accident, thanks to
pkg_rolling-replace :-) and found that all is well except that if TLS is
configured on then no mail can be sent or received.  (But, mail in the
queue can be delivered locally.)

The problem is tlsmgr failing to create the PRNG exchange file.

Mar  3 20:26:54 foo postfix/tlsmgr[20577]: fatal: tls_prng_exch_open: cannot 
open PRNG exchange file /var/lib/postfix/prng_exch: Permission denied uid 0 12 
0 12 /var/spool/postfix

(I added uid and: uid euid gid egid getcwd.)

/var/lib/postfix was there, owned by postfix, which is 12.

I can't figure out if it's in a chroot - seems not to be in master.cf.
And I can't figure out how to ktrace an intermediate process.

Falling back to 2.4.6 makes all work normally (tls in and out).

Has anyone else seen this?  Has anyone else used 2.5.1 with TLS?