This comes from the krb5_sendauth() function call. The protocol used by this
function includes a version string that the remote side can use to verify
that they are speaking the same protocol.

Every time I have seen this problem, it is with the Kerberized Berkeley
r-commands (rlogin, rsh, etc etc). The appropriate server is closing the
remote end of the connection for some reason (for example, if you don't have
tcp wrappers configured to let in Kerberos rlogins) and this is the first
thing that fails.