There's a behavior change in Config.java after 6857795.
Before the change, when system properties are given, and Config.getKDCList(realm) called on a realm that's not the default realm, the default KDC is returned. Now, an exception is thrown if the realm is neither the default one, nor found in krb5.conf.
Also, some comments in Config.java still describe the old behavior.
Fixed: when java.security.krb5.kdc is provided, it will be used as default KDC for a realm if there's no other way to find its KDC.