Here is a pretty good list of all the possible combinations:
1. HMMWV previously bought from the the Atlanta or Barstow auctions: Legal to buy, sell, own etc. By this point most of them that could have been titled have been, so transfer is very easy (just line a normal civilian vehicle). It may still have only a Form 97 which can make it trickier to register. If the paperwork has been lost or is not present then there is very little possibility of getting a title and registration in any state, even though the vehicle was legally purchased originally.
2. HMMWV built from surplussed parts: All of the parts required to assemble complete vehicles have been surplussed at various times or are available for civilian purchase. Titles vary, can be titled as a constructed vehicle if the state allows. Build quality can also vary. I don't know enough about constructed vehicles to comment further.
3. HMMWV listed on Gov. Liq. by accident or for any other reason after the original Atlanta and Barstow auctions: These now require mutilation (and they do verify) by the purchaser after the sale if they are even allowed to be sold. Vehicles that 'slip through' are subject to reclamation by the government if and when they find them. Good luck getting a title. Run from these.
4. HMMWV listed for sale by a state or local agency: In most cases these are owned by the federal government and supplied to the state and local agencies for cheap or no money. They are still federal government property and must be turned in or mutilated after sale just like #3. I have never heard of a HMMWV coming out of a sheriff's office etc that was supplied to them through any other route (ie they bought it in a private sale) and was therefore legal for them to resell. I have seen several ads with vehicles for sale where the ad was pulled shortly after surfacing and the truck was never heard about again. Run from these too. If you buy it and they find you later you will lose the truck and what you paid for it.
5. HMMWV of unknown origin with no title or Form 97: Run!
6. CUCV/M35/Various Other Vehicles: These do not require mutilation (aka demil) after sale and may be sold by Gov. Liq. or state and local agencies to civilians without much restriction.
Note: the age of the HMMWV is not important, it is the avenue with which it has left government service that determines the legality of buying it.