From 49e412eab425f4bd92144c872daee59091101f3d Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 30 Oct 2026 01:30:55 +0000
Subject: [PATCH] upstream: make gssapi-with-mic with malformed OIDs count
 against

MaxAuthTries

Anthropic ANT-2026-8FJ7M9MP

OpenBSD-Commit-ID: 692d5e08a708a04f036efed5ff3f012a15a01ddd
---
 auth2-gss.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/auth2-gss.c b/auth2-gss.c
index 9e9496e53..3e6ae6c94 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.42 2026/07/07 02:17:18 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.43 2026/10/30 01:30:55 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -101,7 +101,10 @@ userauth_gssapi(struct ssh *ssh, const char *method)
 			goid.length   = len - 2;
 			ssh_gssapi_test_oid_supported(&ms, &goid, &present);
 		} else {
+			/* client error; counts against MaxAuthTries */
 			logit_f("badly formed OID received");
+			free(doid);
+			return (0);
 		}
 	} while (mechs > 0 && !present);