Only the macOS Kerberos ticket check reads it, and gssInit only looks up KLCacheHasValidTickets on that path, so the later check can key off the function pointer instead of a separate flag. Differential Revision: https://phabricator.services.mozilla.com/D323878