diff --git a/auth-pam.c b/auth-pam.c
index 5a3ba09b4..832382151 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -375,7 +375,11 @@ import_environments(struct sshbuf *b)
 			error("PAM: pam_putenv: %s",
 			    pam_strerror(sshpam_handle, r));
 		}
-		/* XXX leak env? */
+		/*
+		 * XXX this possibly leaks env because it is not documented
+		 * what pam_putenv() does with it. Does it copy it? Does it
+		 * take ownweship? We don't know, so it's safest just to leak.
+		 */
 	}
 #endif
 }