On pretty much every failed kadmin "action" memory is leaked from krb5_get_error_message(). The attached patch krb5_free_error_message()'s the error message before returning.