PDC was running on a separate subnet, but routed appropriately.
smbclient was returning NT_STATUS_PASSWORD_MUST_CHANGE so I tried:
smbpasswd -r 192.168.1.5 -U myusername
I would authenticate successfully (got a different error if I didn't), but every time smbpasswd would return
I carelessly neglected to preserve running -D,
and once I changed initial password using an RDP connection to a windows machine on the domain, all future smbpasswd calls worked fine.
Oh, was using 3.0.22 - updating to 3.0.23d solved another problem with smbmount, so perhaps they are related.
If I get an opportunity to retest this, and it works with 3.0.23d, I'll close this out.
Closing, feel free to re-open if 3.0.23 does not solve it. If you still got problems, please attach a sniff of the attempt.