It seems to me that XEP-0077 is not RFC compliant in section 3.3 specifically it says:
In order to require additional information before changing the password, the server or service SHOULD return a Data Form in the error stanza:
However https://datatracker.ietf.org/doc/html/rfc6120#section-8.2.3 says:
An IQ stanza of type "error" MAY include the child element contained in the associated "get" or "set" and MUST include an <error/> child
That is to say, it may not contain any child other than an <error/> child and possibly an echo of the request. Now, one could imagine a syntax for embedding a data form in an <error/> but this is not what XEP-0077 describes. Has anyone implemented this part of XEP-0077 in practise? If I return the error with this form will anyone respect it? Do we need to care that this is not RFC compliant or can we squint and say that it's a sort-of echo of the request but with more fields to fill out...