When downstream DNS-over-QUIC (DoQ) is enabled, Unbound documents the 'quic-size' configuration option as the maximum number of bytes for all QUIC buffers and data combined, and states that new connections or streams should be refused/reset once the limit is exceeded. However, an improper validation of the client provided length could allow over allocating memory and trivially exceeding the configured budget for future DoQ connections leading to denial of service for new DoQ clients.