SECURITY UPDATE: out-of-bounds write in the internal DNS server via a
TSIG-signed packet using DNS name compression
debian/patches/CVE-2026-6949.patch: record the start offset of each
dns_res_rec while pulling it and use the last additional record's
offset to truncate the buffer for TSIG verification, instead of
subtracting a re-pushed TSIG record length that can exceed the packet
and underflow packet_len into a huge memcpy() size