Hm. acquire_cred() seems like it always gives you a valid cred handle if it succeeds. Probably the thing to do is to validate verifier_cred_handle in the case where it isn't GSS_C_NO_CREDENTIAL.