diff -ur cyrus-sasl-1.5.24.orig/plugins/gssapi.c cyrus-sasl-1.5.24/plugins/gssapi.c
--- cyrus-sasl-1.5.24.orig/plugins/gssapi.c.orig	Wed Mar  7 19:42:31 2001
+++ cyrus-sasl-1.5.24/plugins/gssapi.c	Wed Mar  7 19:43:35 2001
@@ -1243,7 +1243,7 @@
 
 	/* need bits of layer */
 	allowed = secprops.max_ssf - external;
-	need = secprops.min_ssf - external;
+	need = secprops.min_ssf <  external ? 0 : secprops.min_ssf - external;
 	serverhas = ((char *)output_token->value)[0];
 
 	/* if client didn't set use strongest layer available */