The use of lseek() in xdr_rec.c:xdrrec_getpos() without checking for ESPIPE will fail to handle the common case, resulting in poor behavior in calling code. (In particular auth_gss.c:authgss_marshal() calls gss_get_mic() with rpcbuf.length set to -1, with spectacular results.)
The original MIT Krb5 RPC code lacks this addition, which I'm unclear of the utility of in the first place.
Reverting to the MIT code permits correct function of a trivial RPC client using GSS.
Updated fix.