The "stdarg.h" header file is included twice in "auth-chall.c". It doesn't hurt anything (at least on the systems with which I'm familiar).
Looks like the 2nd one was added in -portable in 2006 ("Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h") and then in 2014 it was added in OpenBSD ("New key API: refactor key-related functions to be more library-like"), rendering the 2nd, older one redundant.
Fixed, thanks! It will be in the 6.9p1 release.
Close all resolved bugs after 7.3p1 release