DS is doing outgoing connections (for example replication agreements). If those connections are doing GSSAPI/KRB authentication at almost the same time, the connections will share the same credential cache. If one authentication fails, it can clear the cache under an other authentication. The consequence can be a crash, if an authentication accesses a credential cache that have been cleared. The fix is to serialize the outgoing GSSAPI authentication. So even if an authentication clear the credential cache, no other pending authentication relies on that cache