- Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain'

logic can shadow a stub/forward zone by a legitimate parent's
  NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.