Reopening. There is a KDC_ERR_NEVER_VALID error code defined in RFC 4120, and present in the error tables, but never emitted by the KDC. The KDC should return that error code instead of producing useless tickets.