There are a number of issues with using TestNG in the 2.2 and 2.3 versions of Surefire, and in particular with more recent versions of TestNG.
Work was originally completed by Jesse Kuhnert to fix a number of the issues here: http://svn.apache.org/viewvc/maven/sandbox/branches/surefire/surefire-collaboration/. This is currently the best working version, however there are concerns about whether it will remain stable over future TestNG releases due to the use of internal APIs (it already appears not to work with 5.6).
Alex Popescu has completed a number of the changes in a simpler fashion and is working on: http://svn.apache.org/viewvc/maven/sandbox/branches/surefire/apopescu/. Many of the changes have been merge to trunk already.
The plan is to merge all changes to trunk as they are reviewed and keep that as the central point of development for Surefire 2.4.
In conjunction with this, it is clear that Surefire needs a higher level of testing and documentation itself, so that work is under way for 2.4 in conjunction with the above to ensure that the functionality remains stable and changeable over time.
What's needed right now if you're contributing:
JIRA is currently up to date with the roadmap for Surefire. The large number of issues in 2.4 are expected to fall out quickly as test coverage increases.