OK. This looks like a problem in 1.6.4p1 of sudo. It isn't a problem with 1.6.3p7_2. 1.6.4 works on -stable, but not -current. It apparently added a call to pam_setcred:
453) Now call pam_setcreds() to setup creds for the target user when PAM is in use. On Linux this often sets resource limits. Warner To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-current" in the body of the message