Ooops. "/" is mounted writeable by /etc/rc; read-only in fstab(5) won't help. You'll have to modify the rc(8) script to keep it read only:
Code:
.
.
.
umount -a >/dev/null 2>&1
mount -a -t nonfs,vnd
mount -uw / # root on nfs requires this, others aren't hurt
rm -f /fastboot # XXX (root now writeable)
.
.
.
Having /root and /home read-only is your choice, based on your needs.
/etc read/write is required by dhclient(8) as it writes resolv.conf(5).