It's unknown how to exactly reproduce this bug but I do have a dump which will
probably be helpful.  I am using Squid (squid-2.5.STABLE3) on Fedora Core 1.  I
am using the ntlm_auth for ntlm authentication in squid.  From time to time, as
users are surfing, they receive a user/password/domain dialog (if they are a
domain member they should never see this).  Within my cache.log, I see the
following logs corresponding to the exact time:

Using a Windows 98 machine:

[2004/06/21 13:30:53, 1] libsmb/ntlmssp.c:ntlmssp_server_auth(549)
  ntlmssp_server_auth: failed to parse NTLMSSP:
[2004/06/21 13:30:53, 2] lib/util.c:dump_data(1886)
  [000] 4E 54 4C 4D 53 53 50 00  03 00 00 00 18 00 18 00  NTLMSSP. ........
  [010] 50 00 00 00 00 00 00 00  68 00 00 00 0C 00 0C 00  P....... h.......
  [020] 34 00 00 00 05 00 05 00  40 00 00 00 0B 00 0B 00  4....... @.......
  [030] 45 00 00 00 53 4F 55 4E  44 54 45 43 48 49 4E 43  E...SOUN DTECHINC
  [040] 44 4F 55 47 4E 53 30 30  32 32 37 32 39 30 32 37  DOUGNS00 22729027
  [050] CD 77 E5 E8 5C 79 51 8F  0E AE 03 1B D6 5E 0B 20  .w..\yQ. .....^.
  [060] 40 A4 E1 C9 C9 00 36 26                           @.....6&
[2004/06/21 13:30:53, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615)
  Got user=[DOUGN] domain=[SOUNDTECHINC] workstation=[S0022729027] len1=24 len2=0
[2004/06/21 13:30:53, 3] utils/ntlm_auth.c:winbind_pw_check(435)
  Login for user [SOUNDTECHINC]\[DOUGN]@[S0022729027] failed due to [Logon failure]

I get very similar results when using some Windows XP Professional machines.