Personally, I feel this exact behavior isn't what we want in reality.  The way I see this, we'd pass through certain errors based on their SQLSTATE during the authentication procedure, and throw ErrBadConn on all others.

Or maybe just throw errors on all connection attempts and forfeit the retrying from inside database/sql.  I feel it would almost never make a difference in practice anyway.