pam_end() already contains a NULL check, and it is not unreasonable to call it with a NULL pamh in a cleanup / error-handling situation. Remove OPENPAM_NONNULL, which may cause gcc to optimize away the NULL check.