Restricted (ksh -r) shell and SSH on AIX5.1

This seems to have been covered ad nauseam on the mailing list before,
but I'm getting an odd behavior out of my system (AIX 5.1, all patched
up):

Configured OpenSSH. Works great.

Have one user I want to be able to use sftp, but not an interactive (ie
SSH/telnet) login.

Set user's shell to /usr/bin/ksh -r)

Now, every time he tries to log in via either ssh *or* sftp, I get the
following showing up in the syslog:

Nov 19 10:21:09 hostname sshd[811106]: User bogus not allowed because
shell /usr/bin/ksh -r is not executable

I've checked /etc/shells, I've checked for typos, I've checked for
missing/bogus links, etc. and nothing seems out of order...I know others
have used various restricted shells before, and I don't think this is so
complex a config that it calls for something like scponly...

Anyone have any ideas? Am I missing something stupidly simple? (and yes,
/usr/bin/ksh *is* executable)

MTIA

Rob