gss_krb5int_make_seal_token_v3_iov fails to set conf_state which results
in gss_wrap_iov returning an incorrect value.  This fixed it for us:

Index: src/lib/gssapi/krb5/k5sealv3iov.c
===================================================================
--- src/lib/gssapi/krb5/k5sealv3iov.c	(revision 24468)
+++ src/lib/gssapi/krb5/k5sealv3iov.c	(working copy)
@@ -269,6 +269,9 @@
 
     code = 0;
 
+    if (conf_state != NULL)
+        *conf_state = conf_req_flag;
+
 cleanup:
     if (code != 0)
         kg_release_iov(iov, iov_count);