diff --git a/auth1.c b/auth1.c
index 06b6712aa..2ebc8d039 100644
--- a/auth1.c
+++ b/auth1.c
@@ -324,6 +324,7 @@ do_authloop(Authctxt *authctxt)
 
 		if (authctxt->failures++ > AUTH_FAIL_MAX) {
 #ifdef WITH_AIXAUTHENTICATE
+			/* XXX: privsep */
 			loginfailed(authctxt->user,
 			    get_canonical_hostname(options.verify_reverse_mapping),
 			    "ssh");
diff --git a/auth2.c b/auth2.c
index 515033f44..6dfd91f74 100644
--- a/auth2.c
+++ b/auth2.c
@@ -233,6 +233,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
 	} else {
 		if (authctxt->failures++ > AUTH_FAIL_MAX) {
 #ifdef WITH_AIXAUTHENTICATE
+			/* XXX: privsep */
 			loginfailed(authctxt->user,
 			    get_canonical_hostname(options.verify_reverse_mapping),
 			    "ssh");