LTM 11.3 with APM: smart card authentication not working

Well, the value you're seeing is an IPv4-translated IPv6 address, so it's left-padded with "ffff". But aside from that, Kerberos uses names, service principal names (SPNs) to be exact. So when APM needs a SPN, it takes the IP address that's been given to it, usually a pool member, and performs a reverse DNS lookup into the domain to get the host name of the server. It then takes that name, let's say for example:

xmlbroker1.mydomain.local    

It then adds the service type and domain realm to make a valid SPN:

http/xmlbroker1.mydomain.local@MYDOMAIN.LOCAL    

I think what you're experiencing here is that the address you're giving to APM doesn't resolve to a name, specifically the host name of the XML broker.