Near the end of gss_accept_sec_context(), we have:

   if (!verifier_cred_handle && cred_handle) {
           krb5_gss_release_cred(minor_status, &cred_handle);
   }

Unfortunately, minor_status is a passed in ref and this call will
clear the error that we expect to be returning to the caller.  This
same class may also affect the my proposed fix to the memory leak
if arg3 == GSS_C_NO_CREDENTIAL in the non-error case in the opposite
sense, that is that code may return non-zero minor_status when
major_status is zero.  That appears to be be less problematic but
should also be fixed once that patch or something like it is adopted.