diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index 536398db0..8c11a925b 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -987,6 +987,24 @@ pk_rd_pa_reply_enckey(krb5_context context,
     p = content.data;
     length = content.length;
 
+#if 0 /* windows LH with interesting CMS packets, leaks memory */
+    {
+	size_t ph = 1 + der_length_len (length);
+	unsigned char *ptr = malloc(length + ph);
+	size_t l;
+
+	memcpy(ptr + ph, p, length);
+
+	ret = der_put_length_and_tag (ptr + ph - 1, ph, length,
+				      ASN1_C_UNIV, CONS, UT_Sequence, &l);
+	if (ret)
+	    return ret;
+	ptr += ph - l;
+	length += l;
+	p = ptr;
+    }
+#endif
+
     /* win2k uses ContentInfo */
     if (type == COMPAT_WIN2K) {
 	ContentInfo ci;