No message issued after successful EXEC CICS VERIFY and unsuccessful attempt count was non-zero

We've recently had two PMR's (22838,7TD,000 and 43772,499,000) where customers received an excessive number of DFHXS1201 messages before a userid was revoked in RACF. On an EXEC CICS VERIFY PASSWORD call, if an invalid password is used and the DFHXS1201 message issued, RACF increases the invalid attempt count. If the number of successive invalid attempts reaches a preset limit (defaults to 3 in RACF, though one customer had it set higher) then the userid is revoked in RACF. Subsequent attempts to VERIFY a password result in DFHXS1203 messages.

However, if there is a SUCCESSFUL attempt to verify a password mixed in with the unsuccessful ones, it can appear that RACF is not working properly, and allowing too many attempts.

For example, if the limit is 3, and the following sequence of events occurs:

Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 1.
Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 2.

Successful attempt. No message, RACF invalid attempt reset to 0.

Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 1.

Successful attempt. No message, RACF invalid attempt reset to 0.

Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 1.
Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 2.

Successful attempt. No message, RACF invalid attempt reset to 0.

Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 1.
Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 2.
Unsuccessful attempt - DFHXS1201. RACF invalid attempt is now 3, and userid revoked.

What the user will see in the above scenario is 8 DFHXS1201 messages, along with 8 ICH408I messages, telling them that an unsuccessful attempt was made, before they see any message about the userid being revoked. On the SUCCESSFUL attempts, no message is written if the call is an EXEC CICS VERIFY PASSWORD, but the RACF count gets reset. This appears as if CICS and RACF are allowing too many unsuccessful attempts.

What would be more helpful to customers for auditability, and for CICS diagnosis is if a new message were issued if a SUCCESSFUL attempt is made AND the prior unsuccessful account was non-zero. This would let them know when the count is being reset to zero again, so that it does not appear. This isn't necessary to do if the call is an EXEC CICS SIGNON, since a successful attempt does already issue a message, but the VERIFY PASSWORD success does not.