Commit 3a4c3ffbfc for bind

commit 3a4c3ffbfc1545192690440183300cb286be53eb
Author: Evan Hunt <each@isc.org>
Date:   Mon Oct 5 20:39:58 2026 -0700

    omit pending data from type-ANY cache responses

    when answering a type-ANY query from the cache, data that hasn't
    been validated yet should only be included in the response if the
    query has the CD bit set.

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index 7c6a24d486..4d66e5150a 100644
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -10,6 +10,8 @@ $TTL 300	; 5 minutes
 ns3			A	10.53.0.3

 a			A	10.0.0.1
+a			AAAA	2001:db8::1
+
 b			A	10.0.0.2
 c			A	10.0.0.3
 d			A	10.0.0.4
diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
index 16568ffd86..af97e44c92 100644
--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
@@ -1423,3 +1423,21 @@ def test_extra_bad_algorithm():
     res2 = isctest.query.tcp(msg, "10.53.0.4")
     isctest.check.same_answer(res1, res2)
     isctest.check.adflag(res2)
+
+
+def test_cd_any(ns4):
+    ns4.rndc("flush")
+    msg = isctest.query.create("a.secure.example", "A")
+    isctest.query.tcp(msg, "10.53.0.4")
+    msg = isctest.query.create("a.secure.example", "AAAA", cd=1)
+    isctest.query.tcp(msg, "10.53.0.4")
+
+    msg = isctest.query.create("a.secure.example", "ANY", cd=1)
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.rr_count_eq(res.answer, 4)
+    isctest.check.noadflag(res)
+
+    msg = isctest.query.create("a.secure.example", "ANY")
+    res = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.rr_count_eq(res.answer, 2)
+    isctest.check.adflag(res)
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 96b2769fd1..f897cb6d18 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7445,6 +7445,11 @@ query_respond_any(query_ctx_t *qctx) {
 			CCTRACE(ISC_LOG_DEBUG(5), "query_respond_any: "
 						  "minimal-any skip rdataset");
 			dns_rdataset_disassociate(qctx->rdataset);
+		} else if (!qctx->is_zone &&
+			   DNS_TRUST_PENDING(qctx->rdataset->trust) &&
+			   !PENDINGOK(qctx->client->query.dboptions))
+		{
+			dns_rdataset_disassociate(qctx->rdataset);
 		} else if ((qctx->qtype == dns_rdatatype_any ||
 			    qctx->rdataset->type == qctx->qtype) &&
 			   !qctx->rdataset->attributes.negative)