* SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC Next Domain Name - debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose next owner name is not a subdomain of the RRSIG signer name in dns_dnssec_verify3() in lib/dns/dnssec.c. - CVE-2026-13321 * SECURITY UPDATE: assertion failure with dns64 and break-dnssec - debian/patches/CVE-2026-19666.patch: clear the noqname alias on the DNS64 filter64 path in query_find() in bin/named/query.c; add the upstream dns64 system test for a partially excluded wildcard AAAA. - CVE-2026-19666 * SECURITY UPDATE: crash on wildcard answers carrying both NSEC and NSEC3 proofs - debian/patches/CVE-2026-80274.patch: record the denial type the validator accepted and use it when caching and serving the NOQNAME proof in lib/dns/validator.c, lib/dns/resolver.c and lib/dns/rdatalist.c; adds dns_rdataset_addnoqnametype() so dns_rdataset_addnoqname() keeps its signature. - CVE-2026-80274 * Add root KSK-2024 (key tag 38696) trust anchor to bind.keys; fresh installs could not validate the root zone after the 2026-10-11 rollover - debian/patches/update_keys.patch: add the 38696 initial-key to bind.keys and the generated bind.keys.h next to the existing 20326 entry (upstream 609bf35075, carried as initial-key because 9.10 has no initial-ds).