Kerberos.NET: Signed PAC: KRB_AP_ERR_MODIFIED

Hi, I got KRB_AP_ERR_MODIFIED Message stream modified after signing a new PAC with krbtgt key. Is that an expected behavior? What need to be in the PAC? It behaves normally if I don’t include a PAC in the ticket.

var pac = new PrivilegedAttributeCertificate(){ };
pac.Encode(krbtgtKey, krbtgtKey);

Thanks!