to avoid the impression that I'm nagging only without
having constructive ideas:-)

some cases where a faithful use of the sysctl is
suboptimal:
- a netboot environment where the kernel files reside
  on a remote filesystem which might or might not be
  accessible at runtime
  (this would require a path substitution; the replacement path
   depends on individual machine setup)
- machines with firmware determined boot strings. For instance,
  on (one of) my pmax systems I get "3/rz0/netbsd". The prefix
  is meaningful - a md translation layer could derive a disk
  device (thus a mountpoint) from it.

What I'd propose is that there is some combination of an
md function and an optional script or replacement rule by
the administrator. This could designate the path to the
"most probable" kernel binary.
If needed, the "version" string in the binary could be checked
against `uname -a` or `sysctl(kern.version)`.
This can be done once in startup, and the path to the kernel
put somewhere into /var/run.

> granted, i don't have the call to secure_path() that getbootfile()
> has...

The secure_path is for the paranoid. It should be possible to override this.
Just to illustrate - in a number of my diskless systems I have something like

if [ -L /netbsd ]; then
        rm /netbsd
        ln -s /sys/arch/i386/compile/`uname -v|awk \
	  '{print $3}'|tr -d '()'`/netbsd
fi

in rc.local to get the right kernel even if only the boot server
was changed.
(I don't recommend this as a general solution, but it should
be possible to put something comparable into some administrator's
rule.)

best regards
Matthias