Going to /bug_report_page.php as an unauthenticated user when $g_allow_anonymous_login = OFF results in a blank page.

I think I have traced this down to a bug in Mantis (2.28.0).

In bug_report_page.php (line 164) it calls access_ensure_project_level( config_get( 'report_bug_threshold' ) ); which calls access_denied() (correctly)
That then, in access_denied (core/access_api.php, line 87, it calls print_header_redirect( helper_mantis_url( auth_login_page( $t_return ) ), p_die: false, false, true ); (I added the p_die: in there, to explain)
In that function, it sets the location header (core/print_api.php, line 129-130) and then (because p_die is false), returns from the function with true.
In the calling function (access_denied) it then skips the else section (core/access_api.php, line 88), and then in line 133 it calls http_response_code(HTTP_STATUS_FORBIDDEN); followed by exit. Calling the http_response_code(...) here overrides the behaviour of web servers to attach a 302 response code when a Location header is present. This means that my browser (Firefox on Linux) sees the 403 error, and not the 302 redirect, resulting in an empty page instead of the redirect.

The fix is simple (as I see it). Instead of calling:
print_header_redirect( helper_mantis_url( auth_login_page( $t_return ) ), false, false, true );
it should call:
print_header_redirect( helper_mantis_url( auth_login_page( $t_return ) ), true, false, true );

This triggers thedie() earlier (in core/print_api.php, line 137), and the HTTP status code doesn't get overridden.