I think that it would be possible to say something like:
While hwloc is BSD licensed, it may potentially link to libraries with more restrictive license terms.
However, that is more or less true of ANY software.
For instance, if I compile some BSD licensed software on AIX with '-static' then IBM's libc ends up in my binary.
I am not saying that IBM's libc poses any specific issues, just using it as an example.
So, this is in no way a unique situation for hwloc.
I think that if hwloc were to explicitly list libpci then we start a dangerous precedent under which users may expect us to continuously "audit" the libs used on various systems.