I have discovered a sequence that reliably reproduces the issue in ISC
BIND 9.11.1-P3:


rndc addzone "test1.baz" '{ type master; file "e.db"; };'
rndc addzone "test2.baz" '{ type master; file "dne.db"; };'
rndc addzone "test2.baz" '{ type master; file "dne.db"; };'
rndc addzone "test3.baz" '{ type master; file "e.db"; };'
rndc delzone "test3.baz"


As hinted at by the filenames, "e.db" should exist and be a proper zone
file while "dne.db" should not exist or not be a proper zone file.

This will allow test1.baz and test3.baz to be created but test2.baz will
not be created because the zone will fail to load.

On the delete of "test3.baz" the .nzf file will suddenly have two entries
for test2.baz.

This suggests that the issue is in how the addzone is rolled back when a
zone fails to load.