A much cleaner, but more invasive, fix would be to stop using SALT_TYPE_AFS_LENGTH to tag AFS salts, and instead use s2kparams along all code paths. Some care would be required to preserve the '@' hack for afs3-salt values.