We don't have any GSSAPI mechanisms in the MIT krb5 tree which exercise either of these bugs, so I was only able to test that my fixes don't break the single-hop case. I stared at the code for a good long time and am fairly confident about the changes I made, but testing would be appreciated.