This is what we get for using in-out parameters. Please test https://github.com/greghudson/krb5/commits/usemaster (just the top commit) to see if it solves your problem. It's not easy for me to test since we don't natively generate AS referrals.