From patch attached to http://krbdev.mit.edu/rt/Ticket/Display.html?id=3349,
at http://krbdev.mit.edu/rt/Ticket/Attachment/23851/13214/kvno.diff, adjusted
as needed to apply to 1.10.  FIXME: I'd like to better handle cases where we
have a new key with the right version stored later in the keytab file.
Currently, we're setting up to overlook that possibility.

Note that this only affects the path taken when krb5_rd_rep() is passed a
server principal name, as without a server principal name it already tries
all of the keys it finds in the keytab, regardless of version numbers.

[rharwood@redhat.com Modify patch to apply to 1.14.1]

Index: krb5/src/kadmin/ktutil/ktutil.c
===================================================================
--- krb5/src/kadmin/ktutil/ktutil.c	(revision 3367)
+++ krb5/src/kadmin/ktutil/ktutil.c	(working copy)
@@ -155,7 +155,7 @@
     char *princ = NULL;
     char *enctype = NULL;
     krb5_kvno kvno = 0;
-    int use_pass = 0, use_key = 0, i;
+    int use_pass = 0, use_key = 0, use_kvno = 0, i;
 
     for (i = 1; i < argc; i++) {
         if ((strlen(argv[i]) == 2) && !strncmp(argv[i], "-p", 2)) {
@@ -164,6 +164,7 @@
         }
         if ((strlen(argv[i]) == 2) && !strncmp(argv[i], "-k", 2)) {
             kvno = (krb5_kvno) atoi(argv[++i]);
+            use_kvno++;
             continue;
         }
         if ((strlen(argv[i]) == 2) && !strncmp(argv[i], "-e", 2)) {
@@ -180,7 +181,7 @@
         }
     }
 
-    if (argc != 8 || !(princ && kvno && enctype) || (use_pass+use_key != 1)) {
+    if (argc != 8 || !(princ && use_kvno && enctype) || (use_pass+use_key != 1)) {
         fprintf(stderr, _("usage: %s (-key | -password) -p principal "
                           "-k kvno -e enctype\n"), argv[0]);
         return;
Index: krb5/src/lib/krb5/keytab/kt_file.c
===================================================================
--- krb5/src/lib/krb5/keytab/kt_file.c	(revision 3367)
+++ krb5/src/lib/krb5/keytab/kt_file.c	(working copy)
@@ -349,7 +349,7 @@
              * Otherwise, remember that we were here so we can return the right
              * error, and free the new.
              */
-            if (new_entry.vno == kvno) {
+            if (new_entry.vno == kvno || new_entry.vno == IGNORE_VNO) {
                 krb5_kt_free_entry(context, &cur_entry);
                 cur_entry = new_entry;
                 if (new_entry.vno == kvno)