Note that s-address is not optional and that krb_mk_safe must fail if the context does not have address bindings. So it's only a matter of a segfault vs an error return. I.E. still a bug but not a very serious one.