From bb894e077f630d824efe0f116b2835672656b16c Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 7 Feb 2026 00:03:30 +0100
Subject: [PATCH] fixup improve the logic

---
 lib/url.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lib/url.c b/lib/url.c
index 49c7dfabe9..cfe398de8b 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1223,13 +1223,20 @@ static bool url_match_auth_nego(struct connectdata *conn,
     return FALSE;
   }
 #endif
-  if((m->want_nego_http &&
-      (conn->http_negotiate_state != GSS_AUTHNONE)) ||
-     (m->want_proxy_nego_http &&
-      (conn->proxy_negotiate_state != GSS_AUTHNONE))) {
-    /* We must use this connection, no other */
-    m->force_reuse = TRUE;
-    return TRUE;
+  if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+    /* Credentials are already checked, we may use this connection. We MUST
+     * use a connection where it has already been fully negotiated. If it has
+     * not, we keep on looking for a better one. */
+    m->found = conn;
+    if((m->want_nego_http &&
+        (conn->http_negotiate_state != GSS_AUTHNONE)) ||
+       (m->want_proxy_nego_http &&
+        (conn->proxy_negotiate_state != GSS_AUTHNONE))) {
+      /* We must use this connection, no other */
+      m->force_reuse = TRUE;
+      return TRUE;
+    }
+    return FALSE; /* get another */
   }
   return TRUE;
 }