FULL PRODUCT VERSION :
A DESCRIPTION OF THE PROBLEM :
gssapi wrap for CFX per-message tokens always set FLAG_ACCEPTOR_SUBKEY even though the acceptor doesn't send a sub key.
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
attach debugger to client and see that the the acceptor doesn't send a subkey in the authenticator, see what it sent FLAG_ACCEPTOR_SUBKEY in all per-message tokens.
EXPECTED VERSUS ACTUAL BEHAVIOR :
send subkey or don't set flag.
This bug can be reproduced always.