diff --git a/bind-9.9-native-pkcs11.patch b/bind-9.9-native-pkcs11.patch
index 2499834..fca6cb4 100644
--- a/bind-9.9-native-pkcs11.patch
+++ b/bind-9.9-native-pkcs11.patch
@@ -5290,13 +5290,13 @@ diff -up bind-9.9.6/lib/dns/gssapi_link.c.native_pkcs11 bind-9.9.6/lib/dns/gssap
 --- bind-9.9.6/lib/dns/gssapi_link.c.native_pkcs11	2014-09-16 21:27:20.000000000 +0200
 +++ bind-9.9.6/lib/dns/gssapi_link.c	2014-10-09 13:30:40.908293739 +0200
 @@ -359,6 +359,7 @@ gssapi_dump(dst_key_t *key, isc_mem_t *m
+ 
  static dst_func_t gssapi_functions = {
  	gssapi_create_signverify_ctx,
- 	gssapi_destroy_signverify_ctx,
 +	NULL, /*%< createctx2 */
+ 	gssapi_destroy_signverify_ctx,
  	gssapi_adddata,
  	gssapi_sign,
- 	gssapi_verify,
 diff -up bind-9.9.6/lib/dns/hmac_link.c.native_pkcs11 bind-9.9.6/lib/dns/hmac_link.c
 --- bind-9.9.6/lib/dns/hmac_link.c.native_pkcs11	2014-09-16 21:27:20.000000000 +0200
 +++ bind-9.9.6/lib/dns/hmac_link.c	2014-10-09 13:30:40.909293740 +0200
diff --git a/bind.spec b/bind.spec
index 2ab452c..d6380e8 100644
--- a/bind.spec
+++ b/bind.spec
@@ -24,7 +24,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  ISC
 Version:  9.9.6
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -1023,6 +1023,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 
 %changelog
+* Wed Oct 22 2014 Petr Spacek <pspacek@redhat.com> - 32:9.9.6-3
+- Fix crash during GSS-TSIG processing (#1155334, #1155127)
+  introduced in 32:9.9.6-2
+
 * Tue Oct 14 2014 Tomas Hozza <thozza@redhat.com> - 32:9.9.6-2
 - Added native PKCS#11 functionality (#1097752)
 - bind-sdb now requires bind due to configuration and other utilities