I presume that by now most of the folks on this list have heard of the CERT advisory on Sendmail. According to the vulnerability notes: http://www.kb.cert.org/vuls/id/834865 NetBSD is listed as "unknown". Can anyone provide better information? Did the NetBSD project or security officer get an early notice?