Code:
g_engfuncs.pfnTraceModel(m_vecWptOrigin, VecBModelOrigin(pLadder), point_hull, pLadder, &tr);
if (tr.flFraction < 1.0)
// tr.vecPlaneNormal is the normal vector of the ladder now
m_vecWptOrigin is the origin of the waypoint, which is always "outside" the ladder.
pfnTraceModel() means a tracehull which is only blocked by the specified entity ("pLadder").