This is fixed upstream in commit a410b7fd, and in Debian sid with openafs 1.4.11+dfsg-5.  I have a PPA build at https://launchpad.net/~anders-kaseorg/+archive/openafs .

openafs (1.4.11+dfsg-5) unstable; urgency=low

  * Apply upstream deltas:
    - [7833e472] Make afsd.pod reflect reality
    - [c9974c7a] Avoid prematurely destroying callback_rxcon
    - [9b37972e] Linux: 2.6.32 - Adapt to writeback changes
    - [abdf72bc] Linux: Avoid deadlock in readdir - release GLOCK for
      filldir
    - [bdb4f98a] Protect rx_call iovq from simultaneous attempts to empty
      it
    - [c08609ae] Avoid using released hosts
    - [a410b7fd] Linux - Fix disk cache access for selinux/AppArmor
      constrained processes (LP: #415766)
    - [49094ccf] Add automatic sysname detection for ARM Linux
    - [525b594a] Make ktc_curpag generally available (LP: #446521)
  * In the postinst of openafs-modules-dkms, if the openafs module is
    already added in DKMS, try to remove it first before adding it.  This
    should more correctly handle the case of a user installing this
    package without the correct kernel headers, having it fail in
    postinst, and then installing the correct headers and having dpkg
    attempt to configure the package again.  Thanks, Philipp Kaluza.
    (Closes: #553542)

 -- Russ Allbery <email address hidden>  Tue, 03 Nov 2009 20:57:21 -0800

openafs (1.4.11+dfsg-4) unstable; urgency=low

  * When changing the name of the source package built by
    openafs-modules-source, we need to change the package name in the
    changelog as well or dpkg-gencontrol explodes.  Thanks, Aaron M.
    Ucko.  (Closes: #549140)

 -- Russ Allbery <email address hidden>  Wed, 30 Sep 2009 18:04:44 -0700

openafs (1.4.11+dfsg-3) unstable; urgency=low

  * Apply upstream deltas:
    - openafs-stable-1_4_x/fileserver-no-negative-fetchdata-20090926:
      never return a negative data length from client reads past the end
      of a file.
    - openafs-stable-1_4_x/fileserver-gethost-r-cleanup-fixes-20090925:
      fix memory leak and possible double-free in error handling cases in
      fileserver.
    - openafs-stable-1_4_x/fileserver-retry-registeraddrs-20090810: retry
      VL_RegisterAddrs in the file server on failure.
    - openafs-stable-1_4_x/kernel-init-vrequest-structure-20090914:
      properly initialize vrequest structure in the kernel.
  * Change the permissions of /var/lib/openafs/local to 0700 to match
    upstream defaults.  This directory contains the fssync.sock file used
    for coordination between the fileserver and the volserver, and
    commands sent to that socket are not authenticated.  Linux protects
    the socket from unprivileged writes by default, but other operating
    systems do not.  Upstream therefore wants this directory to be 0700
    and bosserver will complain by default if it's not.  Changing the
    permissions let us drop a patch to bosserver.
  * Fix the second module control file for the standards version, section,
    and maintainer update.
  * Change the source package name of the stripped package generated by
    openafs-modules-source so that, should someone build a Debian source
    package from it, it won't have the same name as the main openafs
    source package.

 -- Russ Allbery <email address hidden>  Tue, 29 Sep 2009 15:34:58 -0700

openafs (1.4.11+dfsg-2) unstable; urgency=low

  * Add armv5tel to debian/sysname, mapping it to arm_linux26.  Patch from
    Daniel Bayer.  Also make the similar change for the module source
    package.  (Closes: #542315)
  * Also install restorevol in the openafs-client package.
  * Swap maintainer and uploaders in the packaging files for the module
    source package, matching the main package.
  * Update standards version to 3.8.3.
    - Change section of packages generated by openafs-modules-source to
      kernel.
    - Add Homepage to packages generated by openafs-modules-source.

 -- Russ Allbery <email address hidden>  Fri, 21 Aug 2009 19:20:03 -0700