This was originally found by Coverity, although later manual inspection revealed that there may be more bugs.

The call to filter_keys() looks like this:

Performing pointer arithmetic on "keys" in callee "filter_keys". [show details]
694        ret = filter_keys(krbctx, keys, encs);

Note that keys is a simple pointer to a structure. But filter_keys() attempts to use the variable as an array. The statement should probably say ksdata instead of keys:

475            for (j = i; j < n-1; j++) {
Performing pointer arithmetic on "keys" in expression "keys + j".
476                keys[j] = keys[j + 1];
477            }

Another potential problem is that while filter_keys() is modifying the ksdata structure in-place, it is to modifying the enctypes array accordingly. It might be better to build a new array instead of modifying the original in-place.