As reported by Ciwan Öztopal on 2026-0427:

The bug is in dirmngr's bundled libdns resolver code. In dns_rr_cmp, two
union dns_any values are allocated on the stack without initialization and
passed into dns_any_parse. In that path, dns_any_parse calls
dns_any_reinit, which uses dns_any_sizeof(any) and therefore reads
any->rdata.size from uninitialized stack state. For TXT handling,
dns_txt_parse then uses the resulting size in its bounds logic.

A fix is straightforward but it would be useful to scrutinize the use of the union dns_any in more detail.