diff --git a/kdc/524.c b/kdc/524.c
index f4a43d7ae..c4540e755 100644
--- a/kdc/524.c
+++ b/kdc/524.c
@@ -66,7 +66,8 @@ fetch_server (krb5_context context,
 		krb5_get_err_text(context, ret));
 	return ret;
     }
-    ret = _kdc_db_fetch(context, config, sprinc, HDB_F_GET_SERVER, server);
+    ret = _kdc_db_fetch(context, config, sprinc, HDB_F_GET_SERVER, 
+			NULL, server);
     krb5_free_principal(context, sprinc);
     if (ret) {
 	kdc_log(context, config, 0,
diff --git a/kdc/kaserver.c b/kdc/kaserver.c
index 6a11a4b82..ebf3de4a0 100644
--- a/kdc/kaserver.c
+++ b/kdc/kaserver.c
@@ -465,7 +465,8 @@ do_authenticate (krb5_context context,
 	    client_name, from, server_name);
 
     ret = _kdc_db_fetch4 (context, config, name, instance, 
-			  config->v4_realm, HDB_F_GET_CLIENT, &client_entry);
+			  config->v4_realm, HDB_F_GET_CLIENT,
+			  &client_entry);
     if (ret) {
 	kdc_log(context, config, 0, "Client not found in database: %s: %s",
 		client_name, krb5_get_err_text(context, ret));
diff --git a/kdc/kerberos4.c b/kdc/kerberos4.c
index 55d183c5d..7a7bcfeca 100644
--- a/kdc/kerberos4.c
+++ b/kdc/kerberos4.c
@@ -80,7 +80,7 @@ valid_princ(krb5_context context,
     ret = krb5_unparse_name(context, princ, &s);
     if (ret)
 	return FALSE;
-    ret = _kdc_db_fetch(context, ctx->config, princ, ctx->flags, &ent);
+    ret = _kdc_db_fetch(context, ctx->config, princ, ctx->flags, NULL, &ent);
     if (ret) {
 	kdc_log(context, ctx->config, 7, "Lookup %s failed: %s", s,
 		krb5_get_err_text (context, ret));
@@ -111,7 +111,7 @@ _kdc_db_fetch4(krb5_context context,
 				       valid_princ, &ctx, 0, &p);
     if(ret)
 	return ret;
-    ret = _kdc_db_fetch(context, config, p, flags, ent);
+    ret = _kdc_db_fetch(context, config, p, flags, NULL, ent);
     krb5_free_principal(context, p);
     return ret;
 }
@@ -383,7 +383,7 @@ _kdc_do_version4(krb5_context context,
 	}
 
 	ret = _kdc_db_fetch(context, config, tgt_princ,
-			    HDB_F_GET_KRBTGT, &tgt);
+			    HDB_F_GET_KRBTGT, NULL, &tgt);
 	if(ret){
 	    char *s;
 	    s = kdc_log_msg(context, config, 0, "Ticket-granting ticket not "
diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index a048cbde4..e01715735 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -897,7 +897,7 @@ _kdc_as_rep(krb5_context context,
 	    client_name, from, server_name);
 
     ret = _kdc_db_fetch(context, config, client_princ, 
-			HDB_F_GET_CLIENT, &client);
+			HDB_F_GET_CLIENT, NULL, &client);
     if(ret){
 	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", client_name,
 		krb5_get_err_text(context, ret));
@@ -906,7 +906,8 @@ _kdc_as_rep(krb5_context context,
     }
 
     ret = _kdc_db_fetch(context, config, server_princ,
-			HDB_F_GET_SERVER|HDB_F_GET_KRBTGT, &server);
+			HDB_F_GET_SERVER|HDB_F_GET_KRBTGT,
+			NULL, &server);
     if(ret){
 	kdc_log(context, config, 0, "UNKNOWN -- %s: %s", server_name,
 		krb5_get_err_text(context, ret));
diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index 95c4d06a7..cde251f12 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -696,7 +696,7 @@ tgs_parse_request(krb5_context context,
 				       ap_req.ticket.sname,
 				       ap_req.ticket.realm);
     
-    ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, krbtgt);
+    ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, NULL, krbtgt);
 
     if(ret) {
 	char *p;
@@ -925,7 +925,8 @@ tgs_build_reply(krb5_context context,
 	}
 	_krb5_principalname2krb5_principal(&p, t->sname, t->realm);
 	ret = _kdc_db_fetch(context, config, p, 
-			    HDB_F_GET_CLIENT|HDB_F_GET_SERVER, &uu);
+			    HDB_F_GET_CLIENT|HDB_F_GET_SERVER, 
+			    NULL, &uu);
 	krb5_free_principal(context, p);
 	if(ret){
 	    if (ret == HDB_ERR_NOENTRY)
@@ -976,7 +977,7 @@ tgs_build_reply(krb5_context context,
      */
 
 server_lookup:
-    ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER, &server);
+    ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER, NULL, &server);
 
     if(ret){
 	const char *new_rlm;
@@ -1026,7 +1027,7 @@ server_lookup:
 	goto out;
     }
 
-    ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT, &client);
+    ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT, NULL, &client);
     if(ret) {
 	const char *krbtgt_realm; 
 
diff --git a/kdc/misc.c b/kdc/misc.c
index 746e70b2b..47b9ddf60 100644
--- a/kdc/misc.c
+++ b/kdc/misc.c
@@ -42,6 +42,7 @@ _kdc_db_fetch(krb5_context context,
 	      krb5_kdc_configuration *config,
 	      krb5_const_principal principal,
 	      unsigned flags,
+	      HDB **db,
 	      hdb_entry_ex **h)
 {
     hdb_entry_ex *ent;
@@ -66,6 +67,8 @@ _kdc_db_fetch(krb5_context context,
 				       ent);
 	config->db[i]->hdb_close(context, config->db[i]);
 	if(ret == 0) {
+	    if (db)
+		*db = config->db[i];
 	    *h = ent;
 	    return 0;
 	}