diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1889,7 +1889,7 @@
 		if (realgroupmember(u1->cr_rgid, u2))
 			return (0);
 
-		for (int i = 1; i < u1->cr_ngroups; i++)
+		for (int i = 0; i < u1->cr_ngroups; i++)
 			if (realgroupmember(u1->cr_groups[i], u2))
 				return (0);
 
@@ -2265,6 +2265,7 @@
 		}
 	}
 	grpsubset = grpsubset &&
+	    groupmember(obj_cred->cr_gid, active_cred) &&
 	    groupmember(obj_cred->cr_rgid, active_cred) &&
 	    groupmember(obj_cred->cr_svgid, active_cred);