Using a test case, I verified that prior to 0a2f14f752c32a24200363cc6b6ae64a92f81379, the KDC successfully responds to a TGS request with a too-big error if the reply length exceeds max_dgram_reply_size, and after that commit the KDC seg faults with a null dereference.