[kaduk@MIT.EDU - Fri Jan 4 20:30:46 2013]: > kadmin's ktadd, klist -k, and ktutil wrap the displayed kvno at 8 > bits. kadmin's getprinc shows > the correct value. > > For extra fun, kadmin ktremove old picks the wrong entry of the > "current kvno" to remove, at > least sometimes. I guess at least some of this is because the on-disk format stores the kvno in a krb5_octet.