RRSIGs in the wrong section (DS specific)
When querying for DS record in a signed zone, it's RRSIG ends up in the authority section not in the answer.
$ dig +dnssec @localhost ds <name>
; <<>> DiG 9.8.5-rpz2+rl.156.01-P1 <<>> +dnssec @localhost ds <name>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: XXXXX
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;<name>. IN DS
;; ANSWER SECTION:
<name>. 86400 IN DS ...
;; AUTHORITY SECTION:
<name>. 86400 IN RRSIG DS ...
It should be fairly easy to reproduce (just need a zone with DS), when you have the zone, make it a test case as well.