[kaduk@MIT.EDU - Fri Jan  4 20:30:46 2013]:

> kadmin's ktadd, klist -k, and ktutil wrap the displayed kvno at 8
> bits.  kadmin's getprinc shows
> the correct value.
> 
> For extra fun, kadmin ktremove old picks the wrong entry of the
> "current kvno" to remove, at
> least sometimes.

I guess at least some of this is because the on-disk format stores the kvno in a krb5_octet.