SSH message fields allocated before their size is checked

Pre-authentication allocation from the keyboard-interactive response count