Workaround for me was to "make rmconfig" and rebuild -server and -client. Chances are the 8.4.9 update doesn't pass Kerberos-related build options properly, or the upstream packages don't detect it properly any longer. Needs investigation before 9.0!