If a loop is created in /etc/login.conf, for example by including :tc=default: in the default class, cap_mkdb will issue a warning: "cap_mkdb: potential reference loop detected" but still write a non-usable database. Once this has happened authentication attempts fail with "PAM account management error: Error in service module"