There is a second call to do_pam_setcred() in platform.c:platform_setusercontext_post_groups() which was made via the following changeset which doesn't mention a bugID: https://anongit.mindrot.org/openssh.git/commit/platform.c?id=cc12418e18242ce1f61d7035da4956274ba13a96 The comment mentions initgroups(3C) wiping out supplementary groups which only applies in the Linux world if the LinuxPAM pam_group(8) module has been installed and configured which allows one to assign additional secondary groups to a user using /etc/security/group.conf in addition to /etc/group. Note that there is an OpenPAM PAM module of the same name, pam_group(8), which has different functionality, it performs access control based on group membership. There is an earlier call to do_pam_setcred() in main() so this additional call to do_pam_setcred() doesn't need to be called on non-Linux platforms. I don't see any config.h #defines for Linux PAM so this code could be ifdef'ed out for Solaris by including a check for PAM_SUN_CODEBASE.
Does the additional call hurt?