I've successfully mixed the two db apis in 3.x. You just have to be careful to release handles when stepping between APIs. For instance, when I needed to call ad_permission_p,
... 4.x calls ...
db_release_unused_handles
set db [ns_db gethandle]
set admin_p [ad_permission_p $db site_wide]
ns_db releasehandle $db
... back to 4.x API ...
It's a pain, but it's less of a pain than rewriting half the 3.x toolkit.