"gserver" authentication against loadbalanced hosts fails intermittently. Examination shows that the "cvs" service ticket is for a different server than the one cvs connected to.

GSSAPI will do its own resolution of the remote server in
gss_init_sec_context. And netinfo->h_name apparently isn't guaranteed to be the forward+reverse'd-DNS name; in our case it corresponds to the 'server' name.  Together this lead to wrong credentials being retrieved for DNS-loadbalanced servers where the DNS alias changes between connection and GSSAPI-calls.

The proposed patch (against 1.11.17) instead feeds GSSAPI the IP of the remote host (which we already used to connect()) and let GSSAPI figure out the correct credentials for that IP.

The code has changed in 1.12, I don't know whether this is still an issue there. But 1.11 clients are still widely used, so perhaps somebody will find this patch useful..