Revoked-certificate acceptance via mismatched environment variable

Improper CRL handling in FreeBSD allows remote attackers to bypass certificate revocation checks when fetch(1) uses --crl. fetch(1) assigns the CRL pathname to the wrong environment-variable name, so fetch(3) never receives the file and silently ignores the requested revocation list. Exploitation requires a fetch request using --crl and a network host presenting a certificate listed there; the connection proceeds despite the intended distrust.