The Windows gss.exe client allocates memory in its recv_token function which it then attempts to deallocate with gss_buffer_release(). This is a sure fire way to corrupt memory.