* s4u2proxy (k5_get_proxy_cred_from_kdc()) does not do fallback on the service name.  (Neither does krb5_tkt_creds_step() or IAKERB, but that was known at the time of fallback implementation.)