http://bugs.winehq.org/show_bug.cgi?id=22064
--- Comment #64 from Mikko Rasa tdb@tdb.fi 2010-08-30 11:36:00 CDT --- While Hans's patch indeed works in this case, it doesn't quite match what windows does. The header should stay in the buffer the input data was in, regardless of its index. If there's extra data in the input buffer, a buffer of type SECBUFFER_EXTRA should also be filled. The validation code is lacking a check for multiple buffers as well, and hardcoding the MAC size might be bad.
I've prepared a set of patches which I believe are good quality and will send them off to the proper place shortly.