From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 3 Apr 2026 04:33:54 +0000 (+0200)
Subject: fix: usr: Fix wrong NSEC proof for empty non-terminals after IXFR
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=15f058b5a2436eacabca45545880e52a420cc8fe;p=thirdparty%2Fbind9.git

fix: usr: Fix wrong NSEC proof for empty non-terminals after IXFR

When a secondary received an IXFR that transitioned a zone from unsigned to NSEC-signed, queries for empty non-terminal names returned the zone apex NSEC record instead of the NSEC that actually covers the queried name.  The issue only occurred with incremental transfers; a full AXFR or a server restart resolved it.

Closes #5824

Merge branch 'ondrej/fix-nsec-ixfr' into 'main'

See merge request isc-projects/bind9!11786
---

15f058b5a2436eacabca45545880e52a420cc8fe