krb5 with anonymous kinit, "Cannot allocate memory"

[Benjamin Kaduk]

There are certainly some places in the pkinit code where the return value 
is initialized to ENOMEM which can get returned for failures other than 
memory allocation.  It's hard to venture a guess as to which one(s) you 
are running into, though.

Do you have a sense for how reproducible the problem is?  (E.g., on a 
single client/machine level, all requests, somewhere in between.)  If it 
is reproducible, a captured packet could in principle be replayed against 
a debugging KDC and the execution stepped through to find where the error 
is returned.

One coarse-grained factor is whether you are using the openssl or NSS 
backend for pkinit.

-Ben Kaduk