Here's a script I use to prepare the /usr/src area.
Please excuse the mess, I just wanted to get it out to people who might
use it as a base.  There's no reason why people should have to reinvent
all this stuff.
I've messed with it a bit since I last tested it, so be careful
The ip-filter stuff predates my re-write of the kinstall script
(I wanted to see if I could write it only using shell builtins and patch,
and make it smarter in the process).

#! /bin/sh -e
# $Id: update-source,v 1.2 1996/08/19 00:51:17 vax Exp $
# you probably want to save the output of this program
# you probably also want stderr; try:
# update-source > update-source.out 2>&1 &
# tail -f update-source.out     (for the curious)

HW_NAME="${HW_NAME:-`uname -m`}"
src="/usr/src"
archdir="$src/sys/arch/$HW_NAME"
confdir="$archdir/conf"
karch="${HW_NAME}"
argv0=`basename $0`
CVSROOT="${CVSROOT:-/usr/local/share/cvsroot}"
suparea="${suparea:-/usr/sup/netbsd-current/src}"
scratcharea="${scratcharea:-/usr/local/share/src}"
sourcepatches="$HOME/source-patches"

test -z "$nosup" &&
echo Suping files &&
/usr/local/bin/sup -v /usr/local/runtime/sup/supfile.netbsd \
	| mail -s "daily supfile output" root

echo Removing old "$src" files
rm -fr -- "$src"

echo Copying in latest sup files
cp -R -p "$suparea" /usr

echo Checking out config files
# TODO: check out to scratch area
(cd "$confdir" &&
 for i in $CVSROOT/kernelconfigs/*,v; do co $i; done)

# I'm poor on disk space so I maintain some things as patches, some under
# CVS control, and some in other, more obscure ways

echo Making patch files
(cd "$sourcepatches" && make all)

echo Applying patches
(cd "$src" &&
  for i in "$sourcepatches"/*.patch
    do
      echo applying patch $i
      patch < $i
    done)

echo Removing bogus programs
# TODO: remove passwd as well; use a replacement
# rdist has a history of bad security bugs, I don't trust it and don't need it
# TODO: add the near-ten-thousand more insecure programs in here
(cd "$src" &&
   rm -fr -- usr.bin/rdist &&
   perl -pi.orig -e 's/\brdist\b//' usr.bin/Makefile)

echo Enabling i387 support in libm
(cd "$src" &&
  (cd lib/libm && perl -pi.orig \
   -e '$uc = ($uc && s/^\043//)' \
   -e '$uc=1 if /^\043 Uncomment the following lines .* Pentium/;' Makefile)
)

echo Making obj links
(cd "$src" && make obj)

echo Removing SUID perms from Makefiles for unnecessary userland programs
(cd "$src" &&
  (cd usr.sbin/pppd && perl -pi.orig -e \
   '$_ = "BINMODE=" . substr($1,-3) . "\n" if /^BINMODE=([0-9]+)\n/' Makefile)
)

echo Installing ip-filter
# TODO: sync this up with my uber "kinstall" script
(cd "$scratcharea" &&
  rm -rf -- ip-filter
  cvs export -rHEAD ip-filter
  cd ip-filter
  echo -n "Installing "
  for i in ip_fil.[ch] ip_nat.[ch] ip_frag.[ch] ip_state.[ch] fil.c ip_compat.h
  do
    echo -n "$i "
    cp $i $src/sys/netinet/
    chmod 644 $src/sys/netinet/$i
  done
  echo
  cd NetBSD-1.2
  case "$karch" in
  #( balance parens
  i386)
    echo "Patching $archdir/$karch/conf.c"
    cat conf.c-PATCH | (cd $archdir/$karch; patch)
    ;;
  #( balance parens
  *)
    echo "$argv0: not i386 target architecture: $karch" 1>&2
    exit 2
    ;;
  esac
  echo "Patching ip_input.c, ip_output.c and in_proto.c ..."
  cat i*.c-PATCH | (cd $src/sys/netinet; patch)
  echo "Patching $src/sys/conf/files.oldconf ..."
  cat files.oldconf-PATCH | (cd $src/sys/conf; patch)
  echo "Patching $src/sys/conf/files ..."
  cat files-PATCH | (cd $src/sys/conf; patch)
)