passwd(1), while started on telnetd-simulated /dev/cons (via ssh), gets killed for writing on closed pipe after "Confirm:" message. I think it is because of close()/open() race in /sys/src/cmd/ip/telnetd.c:/^conssim/+/open/+/consctl/. Readln opens and closes consctl, and when two readln calls are made, next open may be attempted before the daemon reopens of its end of the simulated consctl.
A fast workaround is injection of sleep(100) between readln calls in /sys/src/cmd/auth/passwd.c:102. Suggestions for the proper fix? - Iaroslav