In order to not get in a quagmire over what is PFS and what isn't, whenever I say PFS here, I just mean "a passive eavesdropper can not retroactively decrypt recorded communications by acquiring your private key".

My understanding of it is this:

- Non-ephemeral ECDH, like DH, means that you have one secret scalar/exponent and a corresponding public key, which is either `xP` (where P is the base point and `x` is the secret) for ECDH or `g**x` for regular DH. This value is encoded in your certificate. Like DSS signed certs, nobody actually uses this. Because your public key is encoded in the certificate, it is fixed, and there is no option to choose different parameters (a prime or a curve), or a different key. It does not provide PFS, because an attacker acquiring your secret `x` and having cleartext-communicated values `yP`/`g**y` sent by the peer, can easily compute `x(yP)`/`(g**x)**y`, exactly the same way that you would when making the connection.
- `OP_SINGLE_ECDH_USE` changes if your ephemeral key is re-used or not. An attacker getting a memory dump with the current value of the secret scalar `x`, combined with eavesdropped communications, can break any connection made with that secret scalar `x`. IIUC, by default, this flag is not enabled, OpenSSL will keep reusing the same key indefinitely as long as that secret scalar is in memory, i.e. it is not cycled after N uses or anything. This provides "practical" PFS to some extent, in that it is way harder to get a memory dump than force someone to hand over the certs (plus you have plausible deniability if the machine gets power cycled).

Are you sure the curve set is used by both? Maybe I'm just totally wrong :)