Currently, comint-watch-for-password-prompt has some problems. It is
called from the comint process filter and doesn't return until the user
exits the password minibuffer.

If the process produces more output while the minibuffer is still open
(this happens if the "sudo" command times out, for example), the process
filter will be called recursively before the current execution of the
process filter has a chance to finish. This filter function uses some
global/buffer-local, state (the variable comint-last-output-start, for
example), so it isn't made to be called simultaneously like that.

The user may also quit the password minibuffer with C-g, canceling
execution of the filter function.

The result of these two events is usually that the buffer text
containing the password prompt isn't correctly marked as output with the
'field text property. Further problems may arise if
comint-output-filter-functions contain functions after the password
prompt watcher.

I've come up with a solution: using (run-at-time 0 ...), we can prompt
for a password after the filter function finishes execution.  The
attached patch implements this for comint, eshell and term.el.

Best regards.