I sent this patch to bugs@ but it appears to have not gone through.

Currently, when you run sysupgrade whilst behind a proxy, it will
download and stage the files correctly, but any connection attempts
during the second stage setup (ramdisk) will fail, as the proxy info
is not passed to the unattend file by sysupgrade, and the user is not
prompted to enter it manually.

The below patch adds that information to the unattend file, if a proxy
was present in the environment during sysupgrade, so it may be used
later (e.g. to download firmware).

Regards
Lloyd

Index: sysupgrade.sh
===================================================================
RCS file: /cvs/src/usr.sbin/sysupgrade/sysupgrade.sh,v
retrieving revision 1.58
diff -u -p -u -p -r1.58 sysupgrade.sh
--- sysupgrade.sh	3 Feb 2025 18:55:55 -0000	1.58
+++ sysupgrade.sh	9 Sep 2025 03:04:38 -0000
@@ -219,6 +219,12 @@ Pathname to the sets = ${SETSDIR}/
 Directory does not contain SHA256.sig. Continue without verification = yes
 __EOT
 
+# If a proxy was needed to fetch the sets, pass it to the unattend file
+[[ -n $http_proxy ]] &&
+	cat <<__EOT >> /auto_upgrade.conf
+HTTP proxy URL = ${http_proxy}
+__EOT
+
 if ! ${KEEP}; then
 	CLEAN=$(echo BUILDINFO SHA256 ${SETS} | sed -e 's/ /,/g')
 	cat <<__EOT > /etc/rc.firsttime