If SEC_WINNT_AUTH_IDENTITY_EXW PackageList is set to a combination which can't be fulfilled (e.g. only unknown packages are set) then it should fail with SEC_E_NO_CREDENTIALS.
Currently SSPI fails during the first call with InitializeSecurityContext in this scenario whereas sspi-rs just continues to use the defaults.