The encoding was updated to align with the latest internet-draft for kerberos-clarifications, which specifies unsigned sequence numbers. The real problem is the re-encoding of the krb-safe message, which really shouldn't happen.