INSIST error from BIND 9.9.9-P6

[Havard Eidnes]

Hi,

one of our recursive resolvers running BIND 9.9.9-P6 stopped last
night, in the log I find:

Apr 19 22:26:30 xxxx named[14737]: resolver.c:4751: INSIST(fctx->type == ((dns_rdatatype_t)dns_rdatatype_any) || fctx->type == ((dns_rdatatype_t)dns_rdatatype_rrsig) || fctx->type == ((dns_rdatatype_t)dns_rdatatype_sig)) failed, back trace
Apr 19 22:26:30 xxxx named[14737]: #0 0x416078 in assertion_failed()+0x43
Apr 19 22:26:30 xxxx named[14737]: #1 0x5934f6 in isc_assertion_failed()+0xa
Apr 19 22:26:30 xxxx named[14737]: #2 0x519059 in validated()+0xdeb
Apr 19 22:26:30 xxxx named[14737]: #3 0x5b13cd in run()+0x294
Apr 19 22:26:30 xxxx named[14737]: #4 0x7f7ff6e0ac1c in _fini()+0x7f7ff682d36c
Apr 19 22:26:30 xxxx named[14737]: #5 0x7f7ff5a83ce0 in _fini()+0x7f7ff54a6430
Apr 19 22:26:30 xxxx named[14737]: exiting (due to assertion failure)

We run dnscap on this host, so I can see the last query which was
answered and the first query which arrived which wasn't answered.

The last answered query was

A? 40.courier-push-apple.com.akadns.net.

The answer was some 576 bytes long, tcpdump said

60846 9/10/8 CNAME pop-eur-scan-courier.push-apple.com.akadns.net., A 17.252.108.23, A 17.252.108.11, A 17.252.108.28, A 17.252.108.19, A 17.252.108.8, A 17.252.108.25, A 17.252.108.14, A 17.252.108.15 (576)

The first query which arrived afterwards and wasn't answered was

A? pltrd001.oam.uninett.no.

That's in an unsecure zone sitting below a DNSSEC-signed zone.  I
checked, and that query had been sent and answered a few seconds
earlier with a TTL of around 1000s, so it probably isn't related
to cache expiry of this particular record.

Any ideas?

- Håvard