p11_child handles (pre-)authentication in two steps. In the first step, it locates a PKCS#11 token that could contain certificates for authentication. In the second step, it checks if there are actually valid, usable certificate(s) on it.

During both steps, filtering is performed based on arguments given to p11_child. If a mismatch occurs during the first step, it simply skips the module/slot/token and goes onto the next one. However if a mismatch occurs in the second step, this is considered a failure; it does not return to the first step to see if a different token contains the right certificates (or to wait for it, if --wait_for_card is given).

To address this, the code needs to be refactored so that the certificate search happens inside the loop that searches/waits for tokens.