Steps to reproduce:

• Add zone with valid NS record but invalid ACL (e.g. update policy)

{{{ ldapadd -v -Y GSSAPI < addbad-update-policy.ldif }}}

• Start named

• Named will log

  zone e.test/IN: failed to parse policy string
  update_zone (psearch) failed for 'idnsName=e.test,cn=dns,dc=e,dc=org'. Zones can be outdated, run rndc reload: unexpected token

• Now reload named

{{{ rndc reload }}}

• Named will crash

  received control channel command 'reload'
  ldap_helper.c:581: fatal error:
  RUNTIME_CHECK(result == 0) failed
  exiting (due to fatal error in library)