Multiple hostnames with same IP address (DNS A record)

[petesea@bigfoot.com]

Is it possible to use Kerberos (specifically OpenSSH w/GSSAPI Key 
Exchange) on a system with 2 hostnames, but both hostnames have the same 
DNS A record and therefore the same IP address?

The problem I'm seeing is OpenSSH using gssapi-keyex authentication only 
seems to work part of the time.  The rest of the time I get the following 
when ssh'ing from a client to this particular host:

   ...
   debug1: Calling gss_init_sec_context
   debug1: Delegating credentials
   debug1: Received GSSAPI_COMPLETE
   debug1: Calling gss_init_sec_context
   debug1: Delegating credentials
   debug1: An invalid name was supplied
   No error

   gss_init_context failed

I'm guessing this is because the client system is confused because 
multiple hostnames are returned from a reverse DNS lookup of the server 
IP.

The odd thing about this is it only fails when ssh'ing FROM a linux 
(redhat/centos) host.  If the connection comes from an OS X host (10.3, 
10.4, 10.5, 10.6) it works 100% of the time.  And, I only have one Solaris 
host (2.8), but it seems to work fine from it as well.  The OS X and 
Solaris hosts are all using various versions of OpenSSH w/GSSAPI Key 
Exchange.

The server is CentOS 4.8 using OpenSSH 5.6 w/GSSAPI Key Exchange.   The 
OpenSSH server was built with statically linked Kerberos 1.6.3.

The host has 2 hostnames, but the DNS A record for both hostnames is the 
same, so:

   $ host external.example.com
   external.example.com has address 1.2.3.4

   $ host internal.example.com
   internal.example.com has address 1.2.3.4

   $ host 1.2.3.4
   4.3.2.1.in-addr.arpa domain name pointer external.example.com.
   4.3.2.1.in-addr.arpa domain name pointer internal.example.com.

There are "host" principals for both hostnames in /etc/krb5.keytab and 
GSSAPIStrictAcceptorCheck is set to "no" in sshd_config.

Is this a bug/deficiency in the standard Kerberos library?  Or a 
bug/deficiency in how OpenSSH is using it?  I'm guessing this, only 
because it seems to work fine when coming from an OS X host and I 
understand OS X uses their own customized Kerberos and/or OpenSSH 
implementation.