Standrad IANAL disclaimer applies...

Using the example of WinZip (or any other small dollar software package), just issue a PO (WinZip is $170 for a 10-pack).

If you can officially let a PO, this is a small enough amount to bring your point to the attention of management without too much fuss.

If you do not have the official ability to let a PO, you'll definitely make an impression on management. If they follow your convictions, you'll catch a little heat, but you may help open their eyes. If they come after you, it is a small enough amount so as to not be a felony. You also have whistleblower protections on your side, so if they push the issue, it comes back onto them.

Either way, you need to push forward on this issue. By bringing it to the attention of management, you have effectively painted a target on your back. They could can you for forgetting the paperclip in your pocket as you walk out the door. Bringing the issue up after the fact won't be worth zip. Pushing forward on your convictions now is the only way to keep yourself straight (whether you remain employed by your company or not).

Yes, Samba did pass on what it found and it appears they were promptly shot down by someone on the *BSD side.

The Samba e-mail archives contain a message from over 3 years ago, but it doesn't give attribution to the *BSD source.

The Samba Bugzilla also has a bug reported more recently involving the same issue. Reading through the bug history, you can see there was one FreeBSD dev involved in the bug discussion, and he referenced a prior conversation between Tridge (Samba) and PHK (FreeBSD) where PHK said there was no bug in FreeBSD.