SERVFAIL answer still contains bogus RRsets
Attached test val_ad_qtype_ds.rpl contains incorrect SOA serial, i.e. RRSIG for . SOA
does not match the SOA RR.
Kresd 3.0.0 correctly detects bogus answer, clears AD bit and sets RCODE=SERVFAIL but the bogus RR is still present in response sent to client:
E id 43842
E opcode QUERY
E rcode SERVFAIL
E flags QR RD RA
E edns 0
E eflags DO
E payload 4096
E ;QUESTION
E test. IN DS
E ;ANSWER
E ;AUTHORITY
E . 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
E test. 86400 IN NSEC . NS RRSIG NSEC
E . 86400 IN RRSIG SOA 8 0 86400 20180922145219 20180823145219 61125 . oUmzRZlxlk8WMI6EVAVqveSrD7gY7dxo g/KF0xIsUgb4wuw7ysD4C1E7GCKA8UqF XKsJn+RpKJHiHAASLctCL8Ewnger2ebe RtTNENEuqyvWlJwWHIY9Bk9YvMr5RzNd TfyLS+EGFGQzk2G793DOoi0DuNFaFK1A kN/jDDzDuGxwK/9oZ4X9Sk2mKeZfjKWI oXaPhMonfnWtX+6rKeMvgSjMZYEXz0+E XYHeHwvtUIPYzMfO2iCrEfCABH04OG61 NP5N9W+IiOKP1KAmT8id3JyFJACHjSP6 BeEIv6Ydzz3M9vq4B4pj0Cr9ePH0GnNC 0Sg8uOfHzjC5bHldoaJs4g==
E test. 86400 IN RRSIG NSEC 8 1 86400 20180922145219 20180823145219 61125 . Fgq94cQgkH4LhB0NFRSzqZT09eLTr4Jd P+xV+s5HEPiipfmaRSy3Y1ZoihtofwjO +LObPVLmyPz7WUWmJBCu3bPRS0GU4Ltq YmpBpUxjuaVqbiw07/GO3IS6nLD1IVYp uXzktncdJDkwalkPb/qMtrMTSEzH5V6a 9CJErKJRIEn36Ypg6+hvKXJT5uJyqcTs eqFXnHDXBzIQjlc6rm7gPCdUCzxx9UrP SxVeNfLSYUV96RA2G1NgksCejP7TPpIi heRXDIItvl/XtQy5pdaPsdE+bJHQaxC2 uTabzvGPoLHRahfCjtH2XxuFsWCSm7ad 0bRQH4v1o05CB8Cv9JkDEQ==
E ;ADDITIONAL
RR . SOA
should not be there, it is bogus.