Check for a nil message and unnecessary auth failures while looping.
The failed password auth was necessary after all. I misread the PoC. :'( Apparently the password auth sets the username, while the backdoored keyboard-interactive auth sets the password.
To match the path, even though it's kinda lame including it just for the monkeypatch.
William Vu