The KDC decodes requests using the libkrb5 ASN.1 DER decoder, but obtains pointers to subsets of the encoding (such as the KDC-REQ-BODY) via its own fetch_asn1_field().  This utility function does not consider the input length, assumes the tag identifier is a single byte, and supports indefinite length encoding.  The libkrb5 decoder accepts multi-byte tag identifiers and does not enforce minimality of tag identifier encoding.  A request packet crafted using a non-minimal tag identifier can pass through the libkrb5 decoder, but fool fetch_asn1_field() into indefinite length processing, which may send it reading beyond the bounds of the packet.