Virtualisation on NetBSD differs abit compared to on FreeBSD. One of the things is that net does not have Bhyve.
But Qemu is of course available.

Host
Install Qemu: doas pkgin install screen mozilla-rootcerts-openssl qemu
Update your /etc/rc.conf with:
auto_ifconfig=NO
net_interfaces="re0 tap0"
securelevel=0
gateway_enable=YES
Update /etc/sysctl.conf:
net.inet.ip.forwarding=1
kern.securelevel=0

Create the /etc/ifconfig.tap0 file, and where re0 is your usual network interface. And the 192.168.6.1 is
the router for your new virtual machine.
create
inet 192.168.6.1 netmask 255.255.255.0
descr "NetBSD VM" up
!ifconfig bridge0 create
!ifconfig bridge0 descr "LAN VM bridge"
!brconfig bridge0 add re0 add tap0 up
For the forwarding from 192.168.6.x to internet to work, you need to add map/NAT to your /etc/npf.conf.
Read the man page for npf.conf. Working example can be found there.
$ext_if = { inet4(re0) }
$int_if = { inet4(tap0) }
table type ipset file "/etc/npf_blocklist"
table type lpm
$services_tcp = { domain, 9022, 9080, 9443 }
$services_udp = { domain, ntp }
$localnet = { 192.168.6.0/24 }
alg "icmp"
# These NAT rules will dynamically select the interface address(es).
map $ext_if dynamic 192.168.6.0/24 -> ifaddrs($ext_if)
map $ext_if dynamic proto tcp 192.168.6.2 port 22 <- ifaddrs($ext_if) port 9022
map $ext_if dynamic proto tcp 192.168.6.2 port 80 <- ifaddrs($ext_if) port 9080
map $ext_if dynamic proto tcp 192.168.6.2 port 443 <- ifaddrs($ext_if) port 9443
procedure "log" {
log: npflog0
}
group "external" on $ext_if {
pass stateful out final all
block in final from
pass stateful in final family inet4 proto tcp to $ext_if port 22 apply "log"
pass stateful in final family inet4 proto tcp to $ext_if port 80 apply "log"
pass stateful in final family inet4 proto tcp to $ext_if port 443 apply "log"
pass stateful in final proto tcp to $ext_if port $services_tcp
pass stateful in final proto udp to $ext_if port $services_udp
}
group "internal" on $int_if {
block in all
block in final from
pass in final from $localnet
pass out final all
}
group default {
pass final on lo0 all
block all
}
Something like above. The magic for outgoing traffic between 192.168.6.x to internet, is the 1st map row and the row: pass in final from $localnet
Also prepared for traffic into the vm, like ssh, http and https. The 3 last mapping rows.
After that, reload the npf config.
doas service npf reload
Then run qemu to install your vm, assuming netbsd for now.
Use 192.168.6.x as your vm ip, and default router 192.168.6.1 then in resolv.conf
use 192.168.0.1 for domain and search(assuming that is your current router)

Guest Assuming default NetBSD install.
Add this to your /etc/rc.conf
securelevel=0
gateway_enable=YES
ip6addrctl=YES
ip6addrctl_policy="ipv4_prefer"
The rows with ip6 is to avoid problems with slow network, because sometimes netbsd can prefer ipv6 rather than ipv4.

This is your /etc/resolv.conf (guest)
search 192.168.0.1
nameserver 192.168.0.1

I dont think this is needed, but i have added also here a row to /etc/sysctl.conf
net.inet.ip.forwarding=1

Should be it, reboot and see that you can ping internet.