Description of problem:
Bind 9.11.13 appears to introduce this Bind bug:  https://gitlab.isc.org/isc-projects/bind9/-/issues/1619   It looks like it's introduced by a different bug fix, which have been presumably backported.

I have two response-policy zones configured. The first zone is a local whitelist with the policy passthru. The second zone is a local blacklist with the policy given. If the blacklist rpz zone contains www.example.com CNAME . (nxdomain) and the whitelist rpz zone contains a wildcard to whitelist *.example.com with *.example.com CNAME rpz-passthru. then this wildcard is ignored.

This has works as intended in Bind 9.11.4, but fails in 9.11.13


Version-Release number of selected component (if applicable):
9.11.13

How reproducible:
Continually, whenever a host-level RPZ block interacts with a wildcard-level PASSTHRU

Steps to Reproduce:
1. Install bind release 9.11.13
2. Use the named.conf and whitelist.zone, blacklist.zone listed below
3. Start bind e.g. systemctl start named
4. Use dig to check the behavior and check the logs

dig @::1 www.example.com


Actual results:
The wildcard passthru entry in the whitelist.zone is ignored.

Expected results:
The wildcard passthru entry in the whitelist.zone is used.

Relevant configuration files

Used named.conf

logging {
	channel "default_debug" {
		file "named.log";
		severity info;
		print-time yes;
		print-severity yes;
		print-category yes;
	};
};
options {
	directory "/var/named/data";
	listen-on port 53 {
		127.0.0.1/32;
	};
	listen-on-v6 port 53 {
		::1/128;
	};
	dnssec-enable yes;
	dnssec-validation auto;
	empty-zones-enable yes;
	recursion yes;
	response-policy {
		zone "whitelist.zone" policy passthru;
		zone "blacklist.zone" policy given;
	} break-dnssec yes;
	allow-query {
		"localhost";
	};
	allow-transfer {
		"localhost";
	};
};
zone "whitelist.zone" {
	type master;
	file "whitelist.zone";
	allow-query {
		"none";
	};
};
zone "blacklist.zone" {
	type master;
	file "blacklist.zone";
	allow-query {
		"none";
	};
};

Used whitelist.zone

$ORIGIN whitelist.zone.
$TTL 3600
@		IN SOA ns.whitelist.zone.  hostmaster.whitelist.zone. 1 600 300 604800 3600
		IN NS	ns2.switch.ch.

example.com	CNAME rpz-passthru.
*.example.com	CNAME rpz-passthru.

Used blacklist.zone

$ORIGIN blacklist.zone.
$TTL 3600
@		IN SOA ns.blacklist.zone.  hostmaster.blacklist.zone. 1 600 300 604800 3600
		IN NS	ns2.switch.ch.

www.example.com	CNAME .
; test record
test.example.org CNAME .

Additional info:
https://gitlab.isc.org/isc-projects/bind9/-/issues/1619