PS. A really nice product!
When calling gssapi import_name function winscp passes in the trailing null. THis is incorrect and blows up the kerberos gss lib I am using.
The problem is here in ssh_gss_import_name
gssbuf.length = sizeof("host@") + strlen(host);
sizeof includes the trailing null on the end of "host@"
I suspect that the MIT kerberos library forgives this error