To make this work, do not use KR_VLDRANK_SECURE as the default value.
It's just too dangerous, and here it complicated determining the
appropriate value for the AD flag.