kadmin's ktadd, klist -k, and ktutil wrap the displayed kvno at 8 bits. kadmin's getprinc shows the correct value. For extra fun, kadmin ktremove old picks the wrong entry of the "current kvno" to remove, at least sometimes.