In spnego_gss_ctx_id_rec, store the set of negotiable mechanisms as well as the currently selected internal_mech, which becomes an alias into mech_set. In init_ctx_reselect, locate the acceptor's counter- proposal in sc->mech_set and consider the token defective if it is not found. https://github.com/krb5/krb5/commit/91e4a3f5db32febb8b95706e4ec3d4642b02b446 Commit By: ghudson Revision: 25590 Changed Files: U trunk/src/lib/gssapi/spnego/gssapiP_spnego.h U trunk/src/lib/gssapi/spnego/spnego_mech.c