The stack doesn't look valid.  krb5_lcc_retrieve() does not attempt to 
free the default realm.  Let's see how the patch behaves.