The previously static pam_conv instance could get reused by multiple threads, causing one to use the password of the other.