I just noticed that everytime I attempt to use sudo as a domain user, I see in ssd_my.domain.log:
[ssd[be[my.domain]]] [watchdog_handler] (0x0010): Watchdog timer overflow, killing process!
This message appears precisely when sudo is done thinking, and prompts for a password.