diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index b718205a4..fd0b20fc0 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -681,6 +681,7 @@ _kdc_pk_rd_padata(astgs_request_t priv,
 	    ret = KRB5KRB_ERR_GENERIC;
 	    krb5_set_error_message(context, ret,
 				   "DH not supported for Win2k");
+	    free_AuthPack_Win2k(&ap);
 	    goto out;
 	}
 	free_AuthPack_Win2k(&ap);