Sorry, it was a false alarm! The cyrus-sasl2 port was compiled incorrectly (--with-gss_impl=mit instead of --with-gss_impl=heimdal) due to a long-forgotten KRB5_HOME defined in /etc/make.conf.
Everything works now. I love Unix, there are no unexplainable or random glitches :) -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:suda...@sibptus.tomsk.ru