* sshd(8): fix circumvention of MaxAuthTries using keyboard-
     interactive authentication. By specifying a long, repeating
     keyboard-interactive "devices" string, an attacker could request
     the same authentication method be tried thousands of times in
     a single pass. The LoginGraceTime timeout in sshd(8) and any
     authentication failure delays implemented by the authentication
     mechanism itself were still applied. Found by Kingcope.

That's a pretty big hole. See also: http://seclists.org/fulldisclosure/2015/Jul/92