Backport fix for CVE-2026-11331 from upstream. The patch
corrects RPZ name-too-long wildcard expansion in
lib/ns/query.c by changing an `else if` to a standalone `if`,
so that when DNS_R_NAMETOOLONG is returned the function
properly returns the error result (YXDOMAIN response) instead
of falling through to return a self-referential CNAME with
the original address record.
CVE: CVE-2026-11331
Upstream patches:
- dc328a199f.patch
Resolves: RHEL-213768
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
