CVE-2026-19667: upstream hardening backported for parity - reject a negative
cache record that does not fit in a dns_rdata_t; 9.11.4-P2 itself is not
exploitable, because its 4096-byte ncache staging buffer predates upstream
6750780e88 and cannot hold a record large enough to overflow the length field