CVE-2026-19666: clear the NOQNAME proof alias on the DNS64 filter64 path in
query_find(), so query_addnoqnameproof() no longer dereferences the rdataset
that query_filter64() has already returned to the message rdataset pool
CVE-2026-19667: reject negative cache records that do not fit in a
dns_rdata_t; copy_rdataset()/addoptout() now bound the assembled record by
DNS_RDATA_MAXLENGTH instead of letting a 64 KiB record reach
dns_rdataslab_fromrdataset(), where it trips INSIST(length <= 0xffff) and
aborts named
CVE-2026-80274: record the denial type (NSEC or NSEC3) next to the NOQNAME
proof owner so isc__rdatalist_getnoqname() returns the same denial record
isc__rdatalist_addnoqname() selected, instead of the first one in wire order