There is a bug in ksu where it fails to exit with a nonzero status if it forks a child to run the command and the child exits nonzero.

For example:
$ su user1
$ echo 'user2@REALM *' > ~/.k5users
$ su user2
$ kinit user2
$ ksu user1 -e /file-that-does-not-exist

In the above example, ksu exits with status code 0.

The problem is that ksu calls:

waitpid(child_pid, &statusp, WUNTRACED)
exit (statusp);

but should be calling:
exit (WEXITSTATUS(statusp));