Commit 87013c4c1d for bind

commit 87013c4c1d44cf0349f4c1627943138d0caeef88
Author: Evan Hunt <each@isc.org>
Date:   Wed Oct 14 17:38:54 2026 -0700

    send TSIG when NOTIFY is retried over TCP

    NOTIFY messages were not TSIG-signed when retried over TCP. This
    has been fixed.

diff --git a/bin/tests/system/notify/ns3/named.conf.j2 b/bin/tests/system/notify/ns3/named.conf.j2
index a791129072..09dbd5e820 100644
--- a/bin/tests/system/notify/ns3/named.conf.j2
+++ b/bin/tests/system/notify/ns3/named.conf.j2
@@ -18,12 +18,17 @@ options {

 {% include "_common/root.hint.conf" %}

+key "test" {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
 zone "example" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	file "example.bk";
 	# non-responsive notify recipient (no reply, no ICMP errors)
-	also-notify { 10.53.10.53; };
+	also-notify { 10.53.10.53 key test; };
 };

 zone "notify-source-port-test" {
diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
index 668573bdce..305c78f42f 100644
--- a/bin/tests/system/notify/tests.sh
+++ b/bin/tests/system/notify/tests.sh
@@ -226,9 +226,15 @@ test_end
 # above, which should time out at some point; we need to wait for them to
 # appear in the logs in case the tests run faster than the notify timeouts

+check_tsig_retry() {
+  awk '/retrying over TCP/ { after=1; next} after' ns3/named.run \
+    | grep -q 'sending notify(SOA).*: TSIG (test)'
+}
+
 test_start "checking notify to retry over TCP within 45 seconds"
 nextpartreset ns3/named.run
-wait_for_log 45 'retrying over TCP' ns3/named.run || ret=1
+wait_for_log_peek 45 'retrying over TCP' ns3/named.run || ret=1
+retry 10 check_tsig_retry || ret=1
 test_end

 # the TCP timeout is set to 15 seconds, double that for some leeway
diff --git a/lib/dns/notify.c b/lib/dns/notify.c
index 73bedf2ccc..b2f67ebc41 100644
--- a/lib/dns/notify.c
+++ b/lib/dns/notify.c
@@ -377,9 +377,7 @@ notify_send_toaddr(void *arg) {
 	CHECK(notify_createmessage(notify, &message));

 	if (notify->key != NULL) {
-		/* Transfer ownership of key */
-		key = notify->key;
-		notify->key = NULL;
+		dns_tsigkey_attach(notify->key, &key);
 	} else {
 		result = dns_view_getpeertsig(view, &dstip, &key);
 		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {