resolver-conf sets invalid permissions on /tmp/resolv.conf.d/
after booting, the /tmp/resolv.conf.d/ has permissions 0644:
drw-r--r-- 2 root root 60 Nov 1 20:00 /tmp/resolv.conf.d/
caused by line 5 of /etc/hotplug.d/openvpn/40-resolver-integration:
chmod 0644 /tmp/resolv.conf.d
This causes external DNS resolving by dnsmasq being broken, returning status: REFUSED and ; EDE: 14 (Not Ready):
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q4/016670.html
Note that this error appears only after manual restart of dnsmasq, not immediately after boot (so it's harder to spot and detect). changing permissions to 0755 fixes dnsmasq resolving of external hosts.