We seem to have accidentally fixed this in the course of the KfM krb4 merge. Of course, it's now backwards-incompatible with older krb5 libdes425, but compatible with every other plain krb4 implementation out there, I think.