Robbert describes a scenario involving Windows Server KDCs. Were you actually able to reproduce this using the steps followed, and did you use a Windows KDC? I do not see the problem using a current MIT krb5 KDC. It does sound like there might be a relevant difference in behavior between the MIT krb5 1.10 and 1.12 client code, but absent a time differential between client and KDC (which Robbert specifically claims does not exist), I cannot imagine what it would be.