CVE-2026-11622: runaway memory usage in a DNSSEC validating resolver under
a random subdomain attack; superseded generations of a cached RRset stayed
linked while validation kept the node referenced, so the cache grew far
past max-cache-size
CVE-2026-11622: also reference-count the DNAME zone cut headers and
initialise the counter for headers faulted in from a 'map' file, two gaps
the upstream 9.11 fix leaves open