diff --git a/krb5-1.9.1-sendto_poll3.patch b/krb5-1.9.1-sendto_poll3.patch
new file mode 100644
index 0000000..2af8b2d
--- /dev/null
+++ b/krb5-1.9.1-sendto_poll3.patch
@@ -0,0 +1,18 @@
+If we exit the transmit loop cleanly, don't overestimate the size of the
+connections array.  This bug appears to have been removed upstream when
+this function was rewritten in trunk, and the select()-based implementation
+is still what's in 1.9, so this patch has nowhere to go.
+--- krb5-1.9.1/src/lib/krb5/os/sendto_kdc.c	2011-09-28 14:54:20.560811664 -0400
++++ krb5-1.9.1/src/lib/krb5/os/sendto_kdc.c	2011-09-28 14:54:11.396812292 -0400
+@@ -1317,7 +1319,10 @@ krb5int_sendto (krb5_context context, co
+            call with the last one from the above loop, if the loop
+            actually calls select.  */
+         sel_state->end_time.tv_sec += delay_this_pass;
+-        e = service_fds(context, sel_state, conns, host+1, &winning_conn,
++        i = host+1;
++        if (i > n_conns)
++            i = n_conns;
++        e = service_fds(context, sel_state, conns, i, &winning_conn,
+                         sel_state+1, msg_handler, msg_handler_data);
+         if (e)
+             break;
diff --git a/krb5.spec b/krb5.spec
index 3f3c6d5..b08679b 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -6,7 +6,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.9.1
-Release: 15%{?dist}
+Release: 16%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.1-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -62,6 +62,7 @@ Patch85: krb5-trunk-gss_delete_sec.patch
 Patch86: krb5-1.9-debuginfo.patch
 Patch87: krb5-1.9.1-sendto_poll2.patch
 Patch88: krb5-1.9-crossrealm.patch
+Patch89: krb5-1.9.1-sendto_poll3.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -221,6 +222,7 @@ ln -s NOTICE LICENSE
 %patch86 -p0 -b .debuginfo
 %patch87 -p1 -b .sendto_poll2
 %patch88 -p1 -b .crossrealm
+%patch89 -p1 -b .sendto_poll3
 gzip doc/*.ps
 
 sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex
@@ -706,6 +708,8 @@ exit 0
   syntax
 - kprop.service: add missing Type=forking so that systemd doesn't assume simple
 - kprop.service: expect the ACL configuration to be there, not absent
+- handle a harder-to-trigger assertion failure that starts cropping up when we
+  exit the transmit loop on time (#739853)
 
 * Sun Oct  2 2011 Tom Callaway <spot@fedoraproject.org> 1.9.1-15
 - hardcode pid file as option in krb5kdc.service