krb5_kdc_process_request() must return 0 when it produces a reply, and only return non-zero when it could not construct any kind of reply (e.g., ENOMEM, or -1 if no handler claimed responsibility for the request).