Hans Leidekker (@hans) commented about dlls/kerberos/krb5_ap.c:
} if ((idx = get_buffer_index( output, SECBUFFER_TOKEN )) == -1) return SEC_E_INVALID_TOKEN;
if (context_req & ISC_REQ_ALLOCATE_MEMORY)
{
output->pBuffers[idx].pvBuffer = RtlAllocateHeap( GetProcessHeap(), 0, KERBEROS_MAX_BUF );
if (!output->pBuffers[idx].pvBuffer) return STATUS_NO_MEMORY;
'target' should be freed before returning.