It seems that OpenBSD people has then patched cvs vulnerablity, though. In this version, OpenBSD has pf(4) improved a lot!