The kdc.conf man page, as installed, mentions pathnames like @LOCALSTATEDIR/krb5kdc/kadm5.acl. Looks like the intent was for substitutions to get done; it just doesn't happen that way.