> but missed one of the three ways crypt can signal failure (returning the input unmodified)
Returning the input unmodified is not failure, but success. That's how you check that a password is valid without having a specialized API.
Returning the input unmodified is not failure, but success. That's how you check that a password is valid without having a specialized API.
<strike>crypt is the hashing function, not the password checking function</strike>
So returning the original hash for a valid password is the success case.