diff --git a/lib/krb5/test_acl.c b/lib/krb5/test_acl.c
index 1e1ef14af..4552d67ac 100644
--- a/lib/krb5/test_acl.c
+++ b/lib/krb5/test_acl.c
@@ -86,6 +86,9 @@ test_match_string(krb5_context context)
     ret = krb5_acl_match_string(context, "foo bar", "sr", "bar", &s1);
     RETVAL(context, ret, EACCES, "ret mismatch");
     if (s1 != NULL) krb5_errx(context, 1, "s1 not NULL");
+
+    ret = krb5_acl_match_string(context, "foo", "l", "foo");
+    RETVAL(context, ret, EINVAL, "unknown letter");
 }