Looks like this is a legitimate bug in how we build smbk5pwd. It's not linking -lkrb5, so it doesn't see its versioned symbols. This would have been introduced when we switched to heimdal-multidev and started using krb5-config, so quite a while ago.