untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQT259PM1AAcZuaBttAcDYuG6LuuE+Vio/h3QKQpzuESujYBEPzjwnjrOeL6A/OoQ/6i/fcASc5ZMpCgzKDnPDwQs=

OpenBSD 6.5 errata 020, December 3, 2019:

Environment-provided paths are used for dlopen() in mesa, resulting in
escalation to the auth group in xlock(1).

Apply by doing:
    signify -Vep /etc/signify/openbsd-65-base.pub -x 020_mesaxlock.patch.sig \
        -m - | (cd /usr/xenocara && patch -p0)

And then compile and rebuild Mesa and xlock
    cd /usr/xenocara/lib/mesa
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build
    cd /usr/xenocara/app/xlockmore
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build

Index: lib/mesa/src/glx/dri_common.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/glx/dri_common.c,v
diff -u -p -u -r1.9 dri_common.c
--- lib/mesa/src/glx/dri_common.c	29 Jan 2019 11:52:21 -0000	1.9
+++ lib/mesa/src/glx/dri_common.c	3 Dec 2019 01:00:26 -0000
@@ -110,7 +110,7 @@ driOpenDriver(const char *driverName)
    glhandle = dlopen(GL_LIB_NAME, RTLD_NOW | RTLD_GLOBAL);
 
    libPaths = NULL;
-   if (geteuid() == getuid()) {
+   if (issetugid() == 0 && geteuid() == getuid()) {
       /* don't allow setuid apps to use LIBGL_DRIVERS_PATH */
       libPaths = getenv("LIBGL_DRIVERS_PATH");
       if (!libPaths)
Index: lib/mesa/src/loader/loader.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/loader/loader.c,v
diff -u -p -u -r1.6 loader.c
--- lib/mesa/src/loader/loader.c	29 Jan 2019 11:52:24 -0000	1.6
+++ lib/mesa/src/loader/loader.c	3 Dec 2019 01:00:26 -0000
@@ -441,7 +441,7 @@ loader_get_driver_for_fd(int fd)
     * user's problem, but this allows vc4 simulator to run on an i965 host,
     * and may be useful for some touch testing of i915 on an i965 host.
     */
-   if (geteuid() == getuid()) {
+   if (issetugid() == 0 && geteuid() == getuid()) {
       driver = getenv("MESA_LOADER_DRIVER_OVERRIDE");
       if (driver)
          return strdup(driver);
Index: app/xlockmore/Makefile.bsd-wrapper
===================================================================
RCS file: /cvs/xenocara/app/xlockmore/Makefile.bsd-wrapper,v
diff -u -p -u -r1.13 Makefile.bsd-wrapper
--- app/xlockmore/Makefile.bsd-wrapper	7 Mar 2017 21:35:57 -0000	1.13
+++ app/xlockmore/Makefile.bsd-wrapper	3 Dec 2019 01:00:34 -0000
@@ -17,6 +17,7 @@ config.status:
 		--enable-appdefaultdir=${X11BASE}/share/X11/app-defaults \
 		--enable-syslog --without-motif --without-ttf \
 		--without-gtk2 --without-gtk --without-esound \
-		--without-rplay --without-ftgl
+		--without-rplay --without-ftgl \
+		--without-opengl --without-mesa
 
 .include <bsd.xorg.mk>