Comment # 7 on bug 1041443 from Michael Schr�der

I can somewhat explain the behavior: dist-upgrade makes sure that all of the
installed packages come from the configured repositories. There's a bit of
special handling for "multiversion" packages like the kernel, though.

With vendor changing allowed, the solver sees that kernel-default-4.4.68 is old
and not in a repository, but there's a newer version available and the
installed version can upgrade to it. So it forces the update, which is a no-op
in your case because it is already installed. The old 4.4.68 kernel is
considered "orphaned", i.e. the solver will deinstall it if it gets in the way,
but it does not mind that it stays installed.

With vendor changing disabled, the solver does not have an valid update
available for the old kernel. But there is a kernel with a different vendor. So
it does not know what to do. The solution part is missing a "deinstall obsolete
kernel" option, though.

The "distupgrade with restrictions" mode needs some more work, I admit. ;)