Has anyone reported this problem to OpenSSL.org (or even to Polarhome.com)? That'd probably be a good idea if you care about this stuff. (I haven't seen anything on the OpenSSL development e-mail forum.)