It appears as if the GSSAPI features are disabled in the openssh binaries, but the hole would still be present in the source, so this issue should still be resolved in the openssh package source. However, openssh-krb5 is likely to be affected in the binaries as the GSSAPI features are enabled there. I have filed a separate bug against openssh-krb5 noting this (#327233). Micah