Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.420 (Entity 5.420) RT-Send-CC: X-RT-Original-Encoding: iso-8859-1 Content-Length: 869 The supplied patch tests conditions which I think will always be true -- that the ccp-com_cdot and scp-com_sdot offsets are the same. So I think it's really only breaking out of the loop when slen and/or clen are 1 and therefore about to be decremented to 0, which would break out of the loop, but only after the decrements of clen, slen, ccp, and scp. The patch quits the loop without those decrements, which changes the code paths following that check for slen==0 or clen==0. This causes a different result if the client and server realms supplied are the same (current code: return KRB5_NO_TKT_IN_RLM; with patch: walk up and down the realm tree). It also causes different results if one realm is above or below the other in the hierarchy, e.g., A.EXAMPLE.COM and EXAMPLE.COM. I've added a test script on the trunk that should exercise this code a bit...