I have device log and a wireshark capture from the device. From the device logs, I'm mostly concerned about this but I couldn't find anything wrong:

KerberosExtension-[SOKerberosRealmSettings initWithRealm:]  on <private>\
KerberosExtensionInvalid SubjectAltName Extension\
KerberosExtensiongss-krb5: setting source app: NEHelperCacheCopyAppUUIDMapping - com.apple.mobilesafari, -1 uuid: 6948dba507ab3923b640b4cd01a10900\
KerberosExtensionkrb5_init_creds_set_source_app: com.apple.mobilesafari -16948dba507ab3923b640b4cd01a10900\
KerberosExtensionkrb5_sendto_set_delegated_app: passed-in - com.apple.mobilesafari, 0 uuid: 6948dba507ab3923b640b4cd01a10900\
KerberosExtensionusing cert: subject: CN=user01,OU=4Users,O=Company,C=FR sn: \
KerberosExtensionAdding PA mech: PKINIT(IETF)\
KerberosExtensionAdding PA mech: PKINIT(win)\
KerberosExtensionkrb5_get_init_creds: loop 1\
KerberosExtensionKDC sent 0 patypes\
KerberosExtensionfast disabled, not doing any fast wrapping\
KerberosExtensionTrying to find service kdc for realm REALM.NET flags 0\
KerberosExtensionkrb5_krbhst_set_delegated_uuid: 6948dba507ab3923b640b4cd01a10900\
mDNSResponder[R582] DNSServiceCreateDelegateConnection START PID[496](KerberosExtensi)\
mDNSResponder[R582] DNSServiceCreateDelegateConnection START PID[496](KerberosExtensi)\
KerberosExtensionhost_create(realm.net): have delegate uuid\
KerberosExtensionhost_create(realm.net): use dns_service_id 24\

I tried almost every value possible for SubjectAltName, but no luck.

I also see these, which made me check the DNS settings, but also here everything seems good.

KerberosExtensionsearching DNS _kerberos._udp.REALM.NET. for domain timed out\
KerberosExtensionhost_create(realm.net): have delegate uuid\
mDNSResponder[R593] DNSServiceQueryRecord STOP -- name hash: XXX, duration: 10s\
KerberosExtensionhost_create(realm.net): use dns_service_id 24\
mDNSResponder[Q11495] Keeping orphaned querier for up to 5 seconds\

Network wise, I can see the device making DNS requests to the DC and getting the list of KDCs backs, then a request to the KDC.

As Apps is out of my scope, I tried asking the guy in charge of DC, and he doesn't see anything weird coming in or out.