The error handling if() blocks at lines 227 and 234 of src/lib/gssapi/krb5/acquire_cred.c are missing krb5_kt_close(context, kt); I don't have a test case, but we noticed while debugging a similar problem.