There's a small problem in su (sh-utils 1.16):

run_shell () is already run with the target user's identity;
when USE_PAM you'll find this code around line 519:

  child = fork();
  if (child == 0) {  /* child shell */

This uses a fork () when we already have the identity of
the target user and does not catch any errors when this
fork fails.

The problem occured when trying to su from root to a
non-root user which already had the maximum number of
possible processes running. Su simply died without doing
anything and there was no error message at all.

One should change this code to make it at least write an
error message to syslog - it is very confusing for root
if the su simply fails without printing an error message.

Martin