https://bugzilla.mindrot.org/show_bug.cgi?id=2982 Added a new patch to the above patch, because it turns out that, besides being freed via gss_release_oid_set, it would be better to do this at the end of the userauth2() function. The reason is, that gss_cleanup is called multiple times when initially more than one gss-method is reported/tried. The gss_supported_mechs list should persist over all tries. Markus