some more notes:

The problem is no server-side problem, because I used an evaluation copy of ADmitMac and had no problems at all binding a Tiger client to an AD Domain. Giving the same amount of information to Directory Access.app (or the command line tool dsconfigad) results in failure. I noticed that the DirectoryService Process forces a rebuild of the /Library/Preferences/mit.edu.Kerberos file – I would be interested in how to prevent that, because the config file that was generated by ADmitMac had other entries.