From: Ondřej Surý <ondrej@isc.org>
Date: Sat, 14 Mar 2026 09:10:34 +0000 (+0100)
Subject: Add invariant check for delegset in rctx_nextserver()
X-Git-Tag: v9.21.21~4^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=792d8a74ab5af8723ecc53a6eb20d1a47ec71b11;p=thirdparty%2Fbind9.git

Add invariant check for delegset in rctx_nextserver()

The get_nameservers path in rctx_nextserver() is only reachable from
rctx_referral(), which already detaches fctx->delegset.  Assert that
it is NULL rather than redundantly detaching it, since
dns_view_bestzonecut() requires *delegsetp == NULL.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 11a57ca681b..25ba14bd736 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -9379,6 +9379,7 @@ rctx_nextserver(respctx_t *rctx, dns_message_t *message,
 		} else {
 			name = fctx->domain;
 		}
+		INSIST(fctx->delegset == NULL);
 		result = dns_view_bestzonecut(fctx->res->view, name, fname,
 					      dcname, fctx->now, findoptions,
 					      true, true, &fctx->delegset);