- Rebase onto the Oracle unbound-1.6.6-5.0.3.el7_8 source RPM - The TuxCare duplicate of the ds_create_dnskey_digest() buffer-length check in validator/val_sigcrypt.c is dropped; the vendor's 1001-orabug40081199 patch carries the same fix and is applied together with its 1002-orabug40081199 regression test - The vendor's two Orabug 37387426 DNSSEC backports (the validation-complexity cap in validator/val_sigcrypt.c and the NSEC3 closest-encloser iteration cap in validator/val_nsec3.c) ship in the source RPM but are not declared or applied; the existing TuxCare backports of the same two upstream commits are kept instead, because the later TuxCare validator work is written against their dnskeyset_verify_rrset_sig() and nsec3_prove_nods() signatures and does not apply on top of the Oracle variants