v9.21.24 -- build OK, exec fails silently ?? v9.21.23 execs OK

[pgnd]

hi

> Look into the use of 'strace'.

yep, had done that.  a bit too noisy, and i missed this

managed to get it to spit out to console

	/usr/local/bind9/bin/named -g -d 3 -u named -c /usr/local/etc/named/named.conf; echo "exit=$?"
		...
		2026-07-22T17:54:48.919-04:00 load_configuration
		2026-07-22T17:54:48.920-04:00 parsing user configuration from '/usr/local/etc/named/named.conf'
		2026-07-22T17:54:48.921-04:00 /usr/local/etc/named/named.conf:456: view 'external-chaos': only Internet (IN) class is allowed
		...
		2026-07-22T17:54:48.923-04:00 loop exclusive mode: starting
		2026-07-22T17:54:48.923-04:00 loop exclusive mode: started
		2026-07-22T17:54:48.923-04:00 loading configuration: failure
		2026-07-22T17:54:48.923-04:00 exiting (due to fatal error)
		exit=1

CHAOS *is* mentioned in release notes re: CVE-2026-5946 / GL #5752 -- "Disable recursion, UPDATE, and NOTIFY for non-IN views." Non-IN views keep authoritative service (version.bind etc. still answer); they lose recursion, UPDATE, NOTIFY.

my config includes

@456
	view "external-chaos" chaos {
		match-clients { any; };
		recursion no;
		zone "." { type hint; file "/dev/null"; };
		zone "bind" {
			type master;
			file "namedb/primary/db.bind.zone";
			...
		};
	};

but that doesn't appear to _have_ recursion, UPDATE, NOTIFY ... so dunno what the specific problem is.

that chaos view i've had for sitting there for ages --  as best as I can remember -- as "standard" version-disclosure hardening, blanking version.bind and authors.bind to empty TXT records; nothing Chaosnet-specific.

if i comment out the chaos block, i think this should now do the same

options {
	...
	version none;
	hostname none;
	server-id none;
	...

those are valid.
and, in builtin.c, iiuc, a side effect of setting version to _anything_ blanks authors.bind  as well.


with that in place, v9.21.24 execs now.

verifying

	dig version.bind   CH TXT | grep -i status
		;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38120
	dig hostname.bind  CH TXT | grep -i status
		;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49775
	dig id.server      CH TXT | grep -i status
		;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15665
	dig authors.bind   CH TXT | grep -i status
		;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 23360

queries are (?) REFUSED, instead of empty replies from the prior chaos config.

not yet clear what i _break_, if anything, by removing the chaos block.