As per upstream advisory:


Samba 4.9 introduced an off-by-default feature to tombstone dynamically created DNS records that had reached their expiry time.

This feature is controlled by the smb.conf option:
 dns zone scavenging = yes

There is a use-after-free issue in this code, essentially due to a call to realloc() while other local variables still point at the original buffer.

The use is a read, but in quite unlikely conditions (due to NDR validation unpacking the buffer) that read memory might be saved back into the DB.