Apply by doing:
       cd /usr/src/usr.sbin
       patch -p0 < 009_httpd.patch

And then rebuild and install httpd and its modules:
       cd httpd
       make -f Makefile.bsd-wrapper obj
       make -f Makefile.bsd-wrapper cleandir
       make -f Makefile.bsd-wrapper depend
       make -f Makefile.bsd-wrapper
       make -f Makefile.bsd-wrapper install

If httpd had been started, you might want to run
       apachectl stop
before running "make install", and
       apachectl start
afterwards.

Index: httpd/src/include/httpd.h
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/src/include/httpd.h,v
retrieving revision 1.17
diff -u -p -r1.17 httpd.h
--- httpd/src/include/httpd.h   2002/10/07 20:23:06     1.17
+++ httpd/src/include/httpd.h   2003/10/29 14:09:15
@@ -290,6 +290,9 @@ extern "C" {
/* The size of the server's internal read-write buffers */
#define IOBUFSIZE 8192

+/* The max number of regex captures that can be expanded by ap_pregsub */
+#define AP_MAX_REG_MATCH 10
+
/* Number of servers to spawn off by default --- also, if fewer than
 * this free when the caretaker checks, it will spawn more.
 */
Index: httpd/src/modules/standard/mod_alias.c
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_alias.c,v
retrieving revision 1.8
diff -u -p -r1.8 mod_alias.c
--- httpd/src/modules/standard/mod_alias.c      2002/08/15 16:06:11     1.8
+++ httpd/src/modules/standard/mod_alias.c      2003/10/29 14:09:19
@@ -303,7 +303,7 @@ static int alias_matches(const char *uri
static char *try_alias_list(request_rec *r, array_header *aliases, int doesc, int *status)
{
    alias_entry *entries = (alias_entry *) aliases->elts;
-    regmatch_t regm[10];
+    regmatch_t regm[AP_MAX_REG_MATCH];
    char *found = NULL;
    int i;

@@ -312,10 +312,10 @@ static char *try_alias_list(request_rec
       int l;

       if (p->regexp) {
-           if (!ap_regexec(p->regexp, r->uri, p->regexp->re_nsub + 1, regm, 0)) {
+           if (!ap_regexec(p->regexp, r->uri, AP_MAX_REG_MATCH, regm, 0)) {
               if (p->real) {
                   found = ap_pregsub(r->pool, p->real, r->uri,
-                                   p->regexp->re_nsub + 1, regm);
+                                       AP_MAX_REG_MATCH, regm);
                   if (found && doesc) {
                       found = ap_escape_uri(r->pool, found);
                   }
Index: httpd/src/modules/standard/mod_rewrite.c
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_rewrite.c,v
retrieving revision 1.16
diff -u -p -r1.16 mod_rewrite.c
--- httpd/src/modules/standard/mod_rewrite.c    2002/10/07 20:23:06     1.16
+++ httpd/src/modules/standard/mod_rewrite.c    2003/10/29 14:09:30
@@ -1769,7 +1769,7 @@ static int apply_rewrite_rule(request_re
    const char *vary;
    char newuri[MAX_STRING_LEN];
    regex_t *regexp;
-    regmatch_t regmatch[MAX_NMATCH];
+    regmatch_t regmatch[AP_MAX_REG_MATCH];
    backrefinfo *briRR = NULL;
    backrefinfo *briRC = NULL;
    int prefixstrip;
@@ -1826,7 +1826,7 @@ static int apply_rewrite_rule(request_re
        rewritelog(r, 3, "[per-dir %s] applying pattern '%s' to uri '%s'",
                   perdir, p->pattern, uri);
    }
-    rc = (ap_regexec(regexp, uri, regexp->re_nsub+1, regmatch, 0) == 0);
+    rc = (ap_regexec(regexp, uri, AP_MAX_REG_MATCH, regmatch, 0) == 0);
    if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
           (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {
        return 0;
@@ -2127,7 +2127,7 @@ static int apply_rewrite_cond(request_re
    char input[MAX_STRING_LEN];
    struct stat sb;
    request_rec *rsub;
-    regmatch_t regmatch[MAX_NMATCH];
+    regmatch_t regmatch[AP_MAX_REG_MATCH];
    int rc;

    /*
@@ -2231,8 +2231,7 @@ static int apply_rewrite_cond(request_re
    }
    else {
        /* it is really a regexp pattern, so apply it */
-        rc = (ap_regexec(p->regexp, input,
-                         p->regexp->re_nsub+1, regmatch,0) == 0);
+        rc = (ap_regexec(p->regexp, input, AP_MAX_REG_MATCH, regmatch,0) == 0);

        /* if it isn't a negated pattern and really matched
           we update the passed-through regex subst info structure */
@@ -2390,7 +2389,7 @@ static void do_expand(request_rec *r, ch
               bri = briRC;
           }
           /* see ap_pregsub() in src/main/util.c */
-            if (bri && n <= bri->nsub &&
+            if (bri && n < AP_MAX_REG_MATCH &&
               bri->regmatch[n].rm_eo > bri->regmatch[n].rm_so) {
               span = bri->regmatch[n].rm_eo - bri->regmatch[n].rm_so;
               if (span > space) {
Index: httpd/src/modules/standard/mod_rewrite.h
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_rewrite.h,v
retrieving revision 1.7
diff -u -p -r1.7 mod_rewrite.h
--- httpd/src/modules/standard/mod_rewrite.h    2002/03/29 02:08:07     1.7
+++ httpd/src/modules/standard/mod_rewrite.h    2003/10/29 14:09:31
@@ -253,8 +253,6 @@

#define MAX_ENV_FLAGS 15

-#define MAX_NMATCH    10
-
/*
**
**  our private data structures we handle with
@@ -356,7 +354,7 @@ typedef struct cache {
typedef struct backrefinfo {
    char *source;
    int nsub;
-    regmatch_t regmatch[10];
+    regmatch_t regmatch[AP_MAX_REG_MATCH];
} backrefinfo;