diff -Nru krb5-1.10.1+dfsg/debian/changelog krb5-1.10.1+dfsg/debian/changelog
--- krb5-1.10.1+dfsg/debian/changelog	2013-03-15 00:17:03.000000000 -0400
+++ krb5-1.10.1+dfsg/debian/changelog	2013-04-04 22:00:52.000000000 -0400
@@ -1,3 +1,10 @@
+krb5 (1.10.1+dfsg-4+nmu2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Use AI_CANONNAME alone when canonicalizing a principle (closes: #704647). 
+
+ -- Michael Gilbert <mgilbert@debian.org>  Fri, 05 Apr 2013 01:57:35 +0000
+
 krb5 (1.10.1+dfsg-4+nmu1) unstable; urgency=high
 
   * Non-maintainer upload by the Security Team.
diff -Nru krb5-1.10.1+dfsg/debian/patches/ai_canonname.patch krb5-1.10.1+dfsg/debian/patches/ai_canonname.patch
--- krb5-1.10.1+dfsg/debian/patches/ai_canonname.patch	1969-12-31 19:00:00.000000000 -0500
+++ krb5-1.10.1+dfsg/debian/patches/ai_canonname.patch	2013-04-04 21:59:34.000000000 -0400
@@ -0,0 +1,15 @@
+Description: Use AI_CANONNAME alone.
+Author: Michael Gilbert <mgilbert@debian.org>
+Origin: http://krbdev.mit.edu/rt/Ticket/Display.html?id=7124
+
+--- krb5-1.10.1+dfsg.orig/src/lib/krb5/os/sn2princ.c
++++ krb5-1.10.1+dfsg/src/lib/krb5/os/sn2princ.c
+@@ -109,7 +109,7 @@ krb5_sname_to_principal(krb5_context con
+                hostnames associated.  */
+ 
+             memset(&hints, 0, sizeof(hints));
+-            hints.ai_flags = AI_CANONNAME | AI_ADDRCONFIG;
++            hints.ai_flags = AI_CANONNAME;
+             err = getaddrinfo(hostname, 0, &hints, &ai);
+             if (err) {
+ #ifdef DEBUG_REFERRALS
diff -Nru krb5-1.10.1+dfsg/debian/patches/series krb5-1.10.1+dfsg/debian/patches/series
--- krb5-1.10.1+dfsg/debian/patches/series	2013-03-15 00:18:29.000000000 -0400
+++ krb5-1.10.1+dfsg/debian/patches/series	2013-04-04 21:58:56.000000000 -0400
@@ -20,3 +20,4 @@
 0020-gssapi-never-unload-mechanisms.patch
 0021-PKINIT-null-pointer-deref-CVE-2013-1415.patch
 cve-2013-1016.patch
+ai_canonname.patch