3880f6a65e
The failed password auth was necessary after all. I misread the PoC. :'( Apparently the password auth sets the username, while the backdoored keyboard-interactive auth sets the password.