We never accepted OpenSSL patches into our tree without looking at them very carefully. At least 50% of the time we would end up committing a different patch because OpenSSL had either introduced new bugs or had failed to fix the reported vulnerability.