Content-Disposition: inline
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: binary
X-RT-Original-Encoding: utf-8
Content-Length: 5941

Suggested fix is in the rt45380 branch.  Please review.

Here is a debug log generated using modified nsupdate:

    --------------------------------------------------------------------
    $ nsupdate -g -D < nsupdate.txt 
    setup_system()
    reset_system()
    user_interaction()
    do_next_command()
    evaluate_update()
    update_addordelete()
    do_next_command()
    start_update()
    recvsoa()
    About to create rcvmsg
    show_message()
    Reply from SOA query:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:   1790
    ;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;ns3.example.			IN	SOA
    
    ;; AUTHORITY SECTION:
    example.		0	IN	SOA	localhost. michal.isc.org. 1 86400 3600 3600000 300
    
    Found zone name: example
    The master is: localhost
    start_gssrequest
    Found realm from ticket: REALM
    send_gssrequest
    show_message()
    Outgoing update query:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  59541
    ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    ;; QUESTION SECTION:
    ;1260325310.sig-localhost.	ANY	TKEY
    
    ;; ADDITIONAL SECTION:
    1260325310.sig-localhost. 0	ANY	TKEY	gss-tsig. 1497444491 1497444491 3 NOERROR 647 YIICgwYGKwYBBQUCoIICdzCCAnOgDTALBgkqhkiG9xIBAgKiggJgBIIC XGCCAlgGCSqGSIb3EgECAgEAboICRzCCAkOgAwIBBaEDAgEOogcDBQAg AAAAo4IBV2GCAVMwggFPoAMCAQWhDxsNSFEuS0VNUE5JVS5QTKIbMBmg AwIBAaESMBAbA0ROUxsJbG9jYWxob3N0o4IBGDCCARSgAwIBEqEDAgEC ooIBBgSCAQJdNb6tzrm3W/YubKnziJWlzVG6YcBRZh2vRgxa+fOItHVR YlvanW+KoWmpbp4UmEK/6RybBEZzfZ2Guwz2MilFJD0XtdamDvnT1z+j Qn6jGwtS4q3M+raoIlcu3DPecCqgdzv+bRPaTQMpUmp5RILD8Y+6qa18 9j7TZiSW2TJTFSdOSIfLNRbfQ7l5XiPzTx9Wsc7y9cUegStpWa/DnysK r9MhjNuuUfA69ZZB57ODYoMmD6gL+N9GepqzJPYuSeb7XqJCBJtnyG6V UXDje4G+6w9JEIh/i8DSHFBPIfTnRRJXcBwSpR5AA6w8PwynyLpBFY1+ MbvbMhMgG1DJqZcc9GqkgdIwgc+gAwIBEqKBxwSBxJb07TctNIsDAT5b qLch2YWNCCpGt6b9GoQ1AKXS8O9dMQDXWaneKJcnJbip3pOxyK7pJU8Z 6MZOvq8ik+JCZFM3N85IHeKYJLuE9ipHrbmOqBa0wYcrTv6rnVoPX7VK ZKMyTEu5rRtzYhcoq0eC5fiSAjPu+rGD++1QfmlV37SuYlOxs/RiypmK slfpVYjQudnYJDV+9kiwHYvxb1d7R29rkRdho1mIE6dQRfePc6EHmBZh +k5lLjhR9kh+Xfd3xrvZ/ls= 0
    
    Out of recvsoa
    recvgss()
    ; Communication with ::1#53 failed: operation canceled
    recvgss: trying next server
    Destroying request [0x7f3d7a2da010]
    send_gssrequest
    show_message()
    Outgoing update query:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:   7354
    ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    ;; QUESTION SECTION:
    ;1260325310.sig-localhost.	ANY	TKEY
    
    ;; ADDITIONAL SECTION:
    1260325310.sig-localhost. 0	ANY	TKEY	gss-tsig. 1497444491 1497444491 3 NOERROR 647 YIICgwYGKwYBBQUCoIICdzCCAnOgDTALBgkqhkiG9xIBAgKiggJgBIIC XGCCAlgGCSqGSIb3EgECAgEAboICRzCCAkOgAwIBBaEDAgEOogcDBQAg AAAAo4IBV2GCAVMwggFPoAMCAQWhDxsNSFEuS0VNUE5JVS5QTKIbMBmg AwIBAaESMBAbA0ROUxsJbG9jYWxob3N0o4IBGDCCARSgAwIBEqEDAgEC ooIBBgSCAQJdNb6tzrm3W/YubKnziJWlzVG6YcBRZh2vRgxa+fOItHVR YlvanW+KoWmpbp4UmEK/6RybBEZzfZ2Guwz2MilFJD0XtdamDvnT1z+j Qn6jGwtS4q3M+raoIlcu3DPecCqgdzv+bRPaTQMpUmp5RILD8Y+6qa18 9j7TZiSW2TJTFSdOSIfLNRbfQ7l5XiPzTx9Wsc7y9cUegStpWa/DnysK r9MhjNuuUfA69ZZB57ODYoMmD6gL+N9GepqzJPYuSeb7XqJCBJtnyG6V UXDje4G+6w9JEIh/i8DSHFBPIfTnRRJXcBwSpR5AA6w8PwynyLpBFY1+ MbvbMhMgG1DJqZcc9GqkgdIwgc+gAwIBEqKBxwSBxJb07TctNIsDAT5b qLch2YWNCCpGt6b9GoQ1AKXS8O9dMQDXWaneKJcnJbip3pOxyK7pJU8Z 6MZOvq8ik+JCZFM3N85IHeKYJLuE9ipHrbmOqBa0wYcrTv6rnVoPX7VK ZKMyTEu5rRtzYhcoq0eC5fiSAjPu+rGD++1QfmlV37SuYlOxs/RiypmK slfpVYjQudnYJDV+9kiwHYvxb1d7R29rkRdho1mIE6dQRfePc6EHmBZh +k5lLjhR9kh+Xfd3xrvZ/ls= 0
    
    recvgss()
    recvgss creating rcvmsg
    show_message()
    recvmsg reply from GSS-TSIG query
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:   7354
    ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;1260325310.sig-localhost.	ANY	TKEY
    
    ;; ANSWER SECTION:
    1260325310.sig-localhost. 0	ANY	TKEY	gss-tsig. 1497444491 1497448091 3 NOERROR 186 oYG3MIG0oAMKAQChCwYJKoZIhvcSAQICooGfBIGcYIGZBgkqhkiG9xIB AgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvuvPWfLf7Whno 1TkY9ykZtTHKOWaywfNzvLrUXzUW4qNjvGZUjDdeYKzaw/U174MzOUxS uIXZLWAdXJLKmZc9Ug+/Gl6IoYxw+kiXvYyCqfLon1mIs8gCK6RHCVID doUpPJqSbfr5r4n4jqRZAZzG 0
    
    send_update()
    Sending update to 127.0.0.1#53
    show_message()
    Outgoing update query:
    ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  23210
    ;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
    ;; UPDATE SECTION:
    ns3.example.		300	IN	A	127.0.0.1
    
    ;; TSIG PSEUDOSECTION:
    1260325310.sig-localhost. 0	ANY	TSIG	gss-tsig. 1497444491 300 28 BAQE//////8AAAAAPQVooIZy8N2gYMTWx4ahaA== 23210 NOERROR 0 
    
    Out of recvgss
    update_completed()
    tsig verification successful
    show_message()
    
    Reply from update query:
    ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  23210
    ;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
    ;; ZONE SECTION:
    ;example.			IN	SOA
    
    ;; TSIG PSEUDOSECTION:
    1260325310.sig-localhost. 0	ANY	TSIG	gss-tsig. 1497444491 300 28 BAQF//////8AAAAAFNIHoOqztmsVwLMcZCrIPw== 23210 NOERROR 0 
    
    done_update()
    reset_system()
    user_interaction()
    cleanup()
    Shutting down task manager
    shutdown_program()
    Shutting down request manager
    Destroy DST lib
    Destroying request manager
    Freeing the dispatchers
    Shutting down dispatch manager
    Destroying event
    Shutting down socket manager
    Shutting down timer manager
    Destroying hash context
    Destroying name state
    Removing log context
    Destroying memory context
    --------------------------------------------------------------------

A PCAP captured during the above nsupdate session is also attached.

I do not think we can prepare a reliable system test for this issue
using our current test infrastructure, but I would love to be proven
wrong.