If the function implementing xcb_connect is called directly with a custom xcb_auth_info_t then checking that the screen in $DISPLAY is valid is skipped.
Matthew Index: xcb_util.c =================================================================== RCS file: /src/datum/openbsd/cvs/xenocara/dist/libxcb/src/xcb_util.c,v retrieving revision 1.13 diff -u -p -r1.13 xcb_util.c --- xcb_util.c 17 Jul 2022 08:31:10 -0000 1.13 +++ xcb_util.c 31 Jan 2023 22:20:24 -0000 @@ -528,10 +528,8 @@ xcb_connection_t *xcb_connect_to_display if(auth) { c = xcb_connect_to_fd(fd, auth); - goto out; } - - if(_xcb_get_auth_info(fd, &ourauth, display)) + else if(_xcb_get_auth_info(fd, &ourauth, display)) { c = xcb_connect_to_fd(fd, &ourauth); free(ourauth.name);