We lock "krb5int_cc_file_mutex" before attempting to open the file in the
we-don't-have-mkstemp() case.  And we shouldn't be trying to unlock it twice.
The function's rewritten in 1.6.4, but fix it here in the meantime.
--- krb5-1.6.3/src/lib/krb5/ccache/cc_file.c	2008-10-28 17:20:13.000000000 -0400
+++ krb5-1.6.3/src/lib/krb5/ccache/cc_file.c	2008-10-28 17:20:07.000000000 -0400
@@ -1976,8 +1976,9 @@ krb5_fcc_generate_new (krb5_context cont
      mktemp(scratch);
      /* Make sure the file name is reserved */
      ret = THREEPARAMOPEN(scratch, O_CREAT | O_EXCL | O_WRONLY | O_BINARY, 0);
      if (ret == -1) {
+	  k5_mutex_unlock(&krb5int_cc_file_mutex);
 	  return krb5_fcc_interpret(context, errno);
      }
 #endif
 
@@ -1995,9 +1996,8 @@ krb5_fcc_generate_new (krb5_context cont
           k5_mutex_unlock(&krb5int_cc_file_mutex);
 	  free(data);
 	  close(ret);
 	  unlink(scratch);
-	  k5_mutex_unlock(&krb5int_cc_file_mutex);
 	  return KRB5_CC_NOMEM;
      }
 
      kret = k5_mutex_init(&data->lock);