undefined indices..

Good catches, thanks.

1. +  if (!isset($_SESSION['captcha_success_form_ids'])) {
+    $_SESSION['captcha_success_form_ids'] = array();
+  }
   $captcha_success_form_ids = (array)($_SESSION['captcha_success_form_ids']);
   
   Good point, but I would do this like
   
      $captcha_success_form_ids = isset($_SESSION['captcha_success_form_ids']) ? (array)($_SESSION['captcha_success_form_ids']) : array();
   
   to avoid writing to $_SESSION when not needed.
2. -    'solution' => $captcha['solution'],
+    'solution' => isset($captcha['solution']) ? $captcha['solution'] : '',
   
   this looks strange. with what challenge module did you get an undefined index warning here?
   Anyway, if the solution is not set, I, think its a bit dangerous to leave it empty, as if the empty answer is the right one. I'll have to look into this.
3. -  $csid = $form_state['clicked_button']['#post']['captcha_sid'];
+  $csid = isset($form_state['clicked_button']['#post']['captcha_sid']) ? $form_state['clicked_button']['#post']['captcha_sid'] : 0;

   
   On which form did you get an undefined index warning here?

ooops totally forgot this issue when posting patch at #349218: Sometimes first character of image CAPTCHA is invisible: weird bug in PHP's bounding box calculation.. well regarding 1, yes sure better although i'm not sure about the cast.. 2) well it happens, form hickups with spam bots and everything... 3) same thing.. might be from aborted page calls or what not?! Just had couple of those in my watchdog table and thought, better make this spam bullet proof...

reproduced problem 1) and committed fix in http://drupal.org/cvs?commit=256840, thanks

concerning 2) and 3) I really would like more info on how to reproduce. Your explanation in #2 is a bit fuzzy :) I immediately don't see how "hickups" and aborted page calls could cause "undefined indices" messages that would not show up on normal page calls in those cases.

For example:
for 2) which CAPTCHA type are you using?
for 3) on which form_ids do you have a CAPTCHA?

well using image captchas, pretty much for all anon form submissions..
thing is, stuff like this ain't always reproducible. i catch those errors from my watchdog, look what causes them, fix/retry and during that usually find some more ;/
so, if you really want to know the exact circumstances of when these occured, maybe i'll put in some debug code. But not right now *g

3) is related to #534168: Submit with "return"/"enter" key in IE7 leads to failing CAPTCHA and it will be solved over there

The remaining thing is 2):

I'd like instruction on how to reproduce this because if $captcha['solution'] is not set, something is seriously wrong. Ignoring this by just blindly setting the solution to an empty string is a bad idea IMHO.