CVE-2026-19666: clear the NOQNAME proof alias on the DNS64 filter64 path in
query_find(), so query_addnoqnameproof() no longer dereferences the rdataset
that query_filter64() had already returned to the message rdataset pool
CVE-2026-19667: reject negative cache records that do not fit in a
dns_rdata_t; a record filling the 64 KiB assembly buffer exactly was stored
with a 16-bit-truncated length of zero and every later reader of it aborted
CVE-2026-80274: record the denial type (NSEC or NSEC3) alongside the NOQNAME
proof owner so that isc__rdatalist_addnoqname() caches and serves the same
denial record the validator accepted