Commit 3711afe493 for bind

commit 3711afe49398dad02f4f7c263325d5c80fb012d8
Author: Ondřej Surý <ondrej@isc.org>
Date:   Tue Sep 22 17:38:26 2026 +0200

    Release the NOQNAME proof rdatasets that were not added

    An ANY response calls query_addnoqnameproof() once per answer RRset
    although they all share one proof, so every call after the first finds
    the record already in the message and gets its rdatasets back unused.
    They hold a slab header reference and a node reference, so leaking them
    lets a client pin cache entries at will.

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 3db718a629..c68959c532 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7284,6 +7284,15 @@ query_addnoqnameproof(query_ctx_t *qctx) {

 	query_addrrset(qctx, &fname, &neg, &negsig, dbuf,
 		       DNS_SECTION_AUTHORITY);
+
+	/*
+	 * For an ANY response this is called once per answer RRset, and
+	 * they all share one proof, so only the first call adds it.  Give
+	 * back what the others allocated; query_addrrset() has already
+	 * dealt with 'fname' either way.
+	 */
+	ns_client_putrdataset(client, &neg);
+	ns_client_putrdataset(client, &negsig);
 }

 static dns_name_t *