In the v2 protocol, after a connection, the accepting process forks in privsep_preauth(). The parent executes monitor_child_preauth() to allow certain privsep requests necessary for authentication. The unprivileged child runs do_ssh2_kex() followed by do_authentication2().

If KEX is fast enough, do_authentication2() runs before the monitor has a 
chance to permit the necessary requests (MONITOR_REQ_PWNAM in articular), 
and therefore authentication fails on the server with:

monitor_read: unpermitted request 6

Damien Miller proposed setting up a pipe shared between the monitor and
child, and making the child wait until the monitor end closes, which
it should do after permitting the monitor calls.

I believe the pipe close (granting permission to continue) should be at the end of monitor.c:mm_answer_sign, right after the line:

monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);

Of course, I could be wrong. On the other hand, I have not been able to figure out where to place the pipe read (waiting for permission) call.