I believe the logic is working as intended. If the first krb5int_locate_server() call succeeds, then it succeeded by finding a profile entry for "kpasswd_server", which is interpreted with a default port of 464.