CVE-2024-43167: guard against a NULL forward-zone name in ub_ctx_set_fwd
to prevent a NULL pointer dereference
CVE-2026-44690: reject RRSIG label counts below the signer label count and
restrict wildcard rrset cache updates to the signer authority, deferring
the cache write until the proof succeeds
CVE-2026-56416: bound the second domain name in canonicalized RDATA and
reject multi-dname RRs whose rdata ends early, preventing a heap buffer
overflow