If we decide to go with a more minimal change for 1.9, inserting a duplicate "krb5_free_creds(context, k_cred);" just after "/* return successfully */" should do it.