If you're using MIT Kerberos, I strongly suspect that the problem you're
seeing is due to the behaviour of its GSSAPI library. With MIT's
implementation a gssapi context is only valid for the lifetime of the
initiator's credential. So, when your clients credentials expire, the
security context also expires, and the client and server both start
failing to decrypt each others packets. We first noticed this problem
because slapd would crash when the decryption failure occurred - this
problem no longer exists - but MIT Kerberos's behaviour has not changed.
Just renewing your credentials won't help, as the new credentials will
only be used when establishing a new security context, which only happens
when a new connection is opened.