Using non-reentrant getpwuid() (or getpwnam(), or getspnam()) can be dangerous. We had a report of a login application / PAM that calls those, and Heimdal, by calling them too, clobbered the cached struct passwd used by the login app / PAM.