Per discussions on krbdev at mit.edu and kerberos at mit.edu, this is not a bug. The source code has been updated to make it clear that k4 tickets need to end five minutes earlier and that not doing so is a security issue.