diff --git a/lib/gssapi/krb5/unwrap.c b/lib/gssapi/krb5/unwrap.c
index 1ca3b1b5c..2e66f30eb 100644
--- a/lib/gssapi/krb5/unwrap.c
+++ b/lib/gssapi/krb5/unwrap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -53,7 +53,7 @@ gss_krb5_get_remotekey(const gss_ctx_id_t context_handle,
 			     context_handle->auth_context, 
 			     &skey);
     if(skey == NULL)
-	return GSS_S_FAILURE;
+	return GSS_KRB5_S_KG_NO_SUBKEY; /* XXX */
     *key = skey;
     return 0;
 }
@@ -86,10 +86,8 @@ unwrap_des
   ret = gssapi_krb5_verify_header (&p,
 				   input_message_buffer->length,
 				   "\x02\x01");
-  if (ret) {
-      *minor_status = 0;
+  if (ret)
       return ret;
-  }
 
   if (memcmp (p, "\x00\x00", 2) != 0)
     return GSS_S_BAD_SIG;
@@ -222,10 +220,8 @@ unwrap_des3
   ret = gssapi_krb5_verify_header (&p,
 				   input_message_buffer->length,
 				   "\x02\x01");
-  if (ret) {
-      *minor_status = 0;
+  if (ret)
       return ret;
-  }
 
   if (memcmp (p, "\x04\x00", 2) != 0) /* HMAC SHA1 DES3_KD */
     return GSS_S_BAD_SIG;
@@ -398,6 +394,8 @@ OM_uint32 gss_unwrap
   }
   krb5_enctype_to_keytype (gssapi_krb5_context, key->keytype, &keytype);
 
+  *minor_status = 0;
+
   switch (keytype) {
   case KEYTYPE_DES :
       ret = unwrap_des (minor_status, context_handle,
diff --git a/lib/gssapi/unwrap.c b/lib/gssapi/unwrap.c
index 1ca3b1b5c..2e66f30eb 100644
--- a/lib/gssapi/unwrap.c
+++ b/lib/gssapi/unwrap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -53,7 +53,7 @@ gss_krb5_get_remotekey(const gss_ctx_id_t context_handle,
 			     context_handle->auth_context, 
 			     &skey);
     if(skey == NULL)
-	return GSS_S_FAILURE;
+	return GSS_KRB5_S_KG_NO_SUBKEY; /* XXX */
     *key = skey;
     return 0;
 }
@@ -86,10 +86,8 @@ unwrap_des
   ret = gssapi_krb5_verify_header (&p,
 				   input_message_buffer->length,
 				   "\x02\x01");
-  if (ret) {
-      *minor_status = 0;
+  if (ret)
       return ret;
-  }
 
   if (memcmp (p, "\x00\x00", 2) != 0)
     return GSS_S_BAD_SIG;
@@ -222,10 +220,8 @@ unwrap_des3
   ret = gssapi_krb5_verify_header (&p,
 				   input_message_buffer->length,
 				   "\x02\x01");
-  if (ret) {
-      *minor_status = 0;
+  if (ret)
       return ret;
-  }
 
   if (memcmp (p, "\x04\x00", 2) != 0) /* HMAC SHA1 DES3_KD */
     return GSS_S_BAD_SIG;
@@ -398,6 +394,8 @@ OM_uint32 gss_unwrap
   }
   krb5_enctype_to_keytype (gssapi_krb5_context, key->keytype, &keytype);
 
+  *minor_status = 0;
+
   switch (keytype) {
   case KEYTYPE_DES :
       ret = unwrap_des (minor_status, context_handle,