diff --git a/aclocal.m4 b/aclocal.m4
index 48cf3807ce..57fc132106 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
 
-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2018 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.
 
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 12 (pkg-config-0.29.2)
-
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29)
+dnl
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -55,7 +55,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.2])
+[m4_define([PKG_MACROS_VERSION], [0.29])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
     [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
 
 pkg_failed=no
-AC_MSG_CHECKING([for $2])
+AC_MSG_CHECKING([for $1])
 
 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])
 
 if test $pkg_failed = yes; then
-        AC_MSG_RESULT([no])
+   	AC_MSG_RESULT([no])
         _PKG_SHORT_ERRORS_SUPPORTED
         if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else
+        else 
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
         ])
 elif test $pkg_failed = untried; then
-        AC_MSG_RESULT([no])
+     	AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
index a1738cd281..9ce8cd7bae 100644
--- a/bin/named/bind9.xsl.h
+++ b/bin/named/bind9.xsl.h
@@ -9,7 +9,7 @@ static char xslmsg[] =
 	" -\n"
 	" - This Source Code Form is subject to the terms of the Mozilla Public\n"
 	" - License, v. 2.0. If a copy of the MPL was not distributed with this\n"
-	" - file, You can obtain one at http://mozilla.org/MPL/2.0/.\n"
+	" - file, you can obtain one at https://mozilla.org/MPL/2.0/.\n"
 	" -\n"
 	" - See the COPYRIGHT file distributed with this work for additional\n"
 	" - information regarding copyright ownership.\n"
diff --git a/config.h.in b/config.h.in
index a45d3780bc..49b73f89b5 100644
--- a/config.h.in
+++ b/config.h.in
@@ -4,7 +4,7 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/configure b/configure
index 87a30f1093..7cb0ea3f3c 100755
--- a/configure
+++ b/configure
@@ -3,7 +3,7 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 #  -----------------------------------------------------------------------------
 #
@@ -979,6 +979,7 @@ infodir
 docdir
 oldincludedir
 includedir
+runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1153,6 +1154,7 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
+runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1405,6 +1407,15 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
+  -runstatedir | --runstatedir | --runstatedi | --runstated \
+  | --runstate | --runstat | --runsta | --runst | --runs \
+  | --run | --ru | --r)
+    ac_prev=runstatedir ;;
+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
+  | --run=* | --ru=* | --r=*)
+    runstatedir=$ac_optarg ;;
+
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1542,7 +1553,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
+		libdir localedir mandir runstatedir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1695,6 +1706,7 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -5080,7 +5092,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$'
   else
@@ -5986,11 +5998,8 @@ _LT_EOF
   test $ac_status = 0; }; then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
-  (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
-  ac_status=$?
-  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&5
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&5 && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -8815,6 +8824,9 @@ $as_echo_n "checking whether the $compiler linker ($LD) supports shared librarie
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    link_all_deplibs=no
+    ;;
   esac
 
   ld_shlibs=yes
@@ -9069,7 +9081,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -9739,6 +9751,7 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	link_all_deplibs=no
       else
 	archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -9760,7 +9773,7 @@ $as_echo "$lt_cv_irix_exported_symbol" >&6; }
       esac
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -10875,6 +10888,18 @@ fi
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -12120,6 +12145,8 @@ $as_echo "no" >&6; }
 fi
 
 # Warn if the user specified libbind, which is now deprecated
+#
+# [pairwise: skip]
 # Check whether --enable-libbind was given.
 if test "${enable_libbind+set}" = set; then :
   enableval=$enable_libbind;
@@ -12135,6 +12162,7 @@ It is available from http://www.isc.org as a separate download." "$LINENO" 5
 		;;
 esac
 
+# [pairwise: --enable-buffer-useinline, --disable-buffer-useinline]
 # Check whether --enable-buffer_useinline was given.
 if test "${enable_buffer_useinline+set}" = set; then :
   enableval=$enable_buffer_useinline; if test yes = "${enable}"
@@ -12149,18 +12177,21 @@ else
 fi
 
 
+# [pairwise: --enable-warn-shadow, --disable-warn-shadow]
 # Check whether --enable-warn_shadow was given.
 if test "${enable_warn_shadow+set}" = set; then :
   enableval=$enable_warn_shadow;
 fi
 
 
+# [pairwise: --enable-warn-error, --disable-warn-error]
 # Check whether --enable-warn_error was given.
 if test "${enable_warn_error+set}" = set; then :
   enableval=$enable_warn_error;
 fi
 
 
+# [pairwise: --enable-developer, --disable-developer]
 # Check whether --enable-developer was given.
 if test "${enable_developer+set}" = set; then :
   enableval=$enable_developer;
@@ -12184,7 +12215,10 @@ yes)
 esac
 
 
-# American Fuzzy Lop
+# American Fuzzy Lop is not included in pairwise testing as fuzzing
+# tools are not present in the relevant Docker image.
+#
+# [pairwise: skip]
 # Check whether --enable-afl was given.
 if test "${enable_afl+set}" = set; then :
   enableval=$enable_afl;
@@ -12199,7 +12233,6 @@ yes)
 esac
 
 
-#libseccomp sandboxing
 for ac_func in getrandom
 do :
   ac_fn_c_check_func "$LINENO" "getrandom" "ac_cv_func_getrandom"
@@ -12211,6 +12244,10 @@ _ACEOF
 fi
 done
 
+
+# libseccomp sandboxing
+#
+# [pairwise: --enable-seccomp, --disable-seccomp]
 # Check whether --enable-seccomp was given.
 if test "${enable_seccomp+set}" = set; then :
   enableval=$enable_seccomp;
@@ -12554,6 +12591,7 @@ default_with_python="python python3 python3.7 python3.6 python3.5 python3.4 pyth
 
 
 
+# [pairwise: --with-python, --without-python]
 
 # Check whether --with-python was given.
 if test "${with_python+set}" = set; then :
@@ -12563,6 +12601,8 @@ else
 fi
 
 
+# [pairwise: skip]
+
 # Check whether --with-python-install-dir was given.
 if test "${with_python_install_dir+set}" = set; then :
   withval=$with_python_install_dir;
@@ -14251,6 +14291,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 #
 # check if we have kqueue
 #
+# [pairwise: --enable-kqueue, --disable-kqueue]
 # Check whether --enable-kqueue was given.
 if test "${enable_kqueue+set}" = set; then :
   enableval=$enable_kqueue; want_kqueue="$enableval"
@@ -14286,6 +14327,7 @@ esac
 # check if we have epoll.  Linux kernel 2.4 has epoll_create() which fails,
 # so we need to try running the code, not just test its existence.
 #
+# [pairwise: --enable-epoll, --disable-epoll]
 # Check whether --enable-epoll was given.
 if test "${enable_epoll+set}" = set; then :
   enableval=$enable_epoll; want_epoll="$enableval"
@@ -14339,6 +14381,7 @@ esac
 #
 # check if we support /dev/poll
 #
+# [pairwise: --enable-devpoll, --disable-devpoll]
 # Check whether --enable-devpoll was given.
 if test "${enable_devpoll+set}" = set; then :
   enableval=$enable_devpoll; want_devpoll="$enableval"
@@ -14661,6 +14704,8 @@ $as_echo "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h
 #
 geoip2_default="no"
 
+# [pairwise: --with-geoip --without-geoip2, --without-geoip --with-geoip2=auto, --without-geoip --with-geoip2=yes, --without-geoip --without-geoip2]
+
 # Check whether --with-geoip was given.
 if test "${with_geoip+set}" = set; then :
   withval=$with_geoip;
@@ -14672,6 +14717,8 @@ else
 fi
 
 
+# [pairwise: skip]
+
 # Check whether --with-geoip2 was given.
 if test "${with_geoip2+set}" = set; then :
   withval=$with_geoip2;
@@ -14693,8 +14740,8 @@ case $with_geoip2 in #(
   auto) :
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libmaxminddb" >&5
-$as_echo_n "checking for libmaxminddb... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for MAXMINDDB" >&5
+$as_echo_n "checking for MAXMINDDB... " >&6; }
 
 if test -n "$MAXMINDDB_CFLAGS"; then
     pkg_cv_MAXMINDDB_CFLAGS="$MAXMINDDB_CFLAGS"
@@ -14734,7 +14781,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -14752,7 +14799,7 @@ fi
 
 	:
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	:
 else
@@ -14793,8 +14840,8 @@ fi ;; #(
   yes) :
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libmaxminddb" >&5
-$as_echo_n "checking for libmaxminddb... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for MAXMINDDB" >&5
+$as_echo_n "checking for MAXMINDDB... " >&6; }
 
 if test -n "$MAXMINDDB_CFLAGS"; then
     pkg_cv_MAXMINDDB_CFLAGS="$MAXMINDDB_CFLAGS"
@@ -14834,7 +14881,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -14861,7 +14908,7 @@ Alternatively, you may set the environment variables MAXMINDDB_CFLAGS
 and MAXMINDDB_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -15362,6 +15409,8 @@ esac
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GSSAPI library" >&5
 $as_echo_n "checking for GSSAPI library... " >&6; }
 
+# [pairwise: --with-gssapi=yes, --with-gssapi=auto, --without-gssapi]
+
 # Check whether --with-gssapi was given.
 if test "${with_gssapi+set}" = set; then :
   withval=$with_gssapi; use_gssapi="$withval"
@@ -15789,6 +15838,8 @@ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for random device" >&5
 $as_echo_n "checking for random device... " >&6; }
 
+# [pairwise: skip]
+
 # Check whether --with-randomdev was given.
 if test "${with_randomdev+set}" = set; then :
   withval=$with_randomdev; use_randomdev="$withval"
@@ -16678,6 +16729,7 @@ if test "x$ac_cv_func_pthread_attr_setstacksize" = xyes; then :
 fi
 
 
+	# [pairwise: --with-locktype=adaptive, --with-locktype=standard]
 
 # Check whether --with-locktype was given.
 if test "${with_locktype+set}" = set; then :
@@ -16963,6 +17015,8 @@ ISC_THREAD_DIR=$thread_dir
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libtool" >&5
 $as_echo_n "checking for libtool... " >&6; }
 
+# [pairwise: --with-libtool, --without-libtool]
+
 # Check whether --with-libtool was given.
 if test "${with_libtool+set}" = set; then :
   withval=$with_libtool; use_libtool="$withval"
@@ -17015,6 +17069,7 @@ esac
 # was --enable-native-pkcs11 specified?
 #  (note it implies both --without-openssl and --with-pkcs11)
 #
+# [pairwise: --enable-native-pkcs11 --with-dlopen, --disable-native-pkcs11 --with-dlopen, --disable-native-pkcs11 --without-dlopen]
 # Check whether --enable-native-pkcs11 was given.
 if test "${enable_native_pkcs11+set}" = set; then :
   enableval=$enable_native_pkcs11; want_native_pkcs11="$enableval"
@@ -17026,6 +17081,7 @@ fi
 #
 # was --with-openssl specified?
 #
+# [pairwise: --with-openssl --enable-openssl-hash, --with-openssl --disable-openssl-hash, --without-openssl]
 
 # Check whether --with-openssl was given.
 if test "${with_openssl+set}" = set; then :
@@ -17038,6 +17094,7 @@ fi
 #
 # was --with-pkcs11 specified?
 #
+# [pairwise: skip]
 
 # Check whether --with-pkcs11 was given.
 if test "${with_pkcs11+set}" = set; then :
@@ -17051,6 +17108,8 @@ fi
 # were --with-ecdsa, --with-gost, --with-eddsa, --with-aes specified
 #
 
+# [pairwise: --with-ecdsa, --without-ecdsa]
+
 # Check whether --with-ecdsa was given.
 if test "${with_ecdsa+set}" = set; then :
   withval=$with_ecdsa; with_ecdsa="$withval"
@@ -17059,6 +17118,11 @@ else
 fi
 
 
+# GOST is not included in pairwise testing as it is not supported by the
+# OpenSSL version present in the relevant Docker image.
+#
+# [pairwise: skip]
+
 # Check whether --with-gost was given.
 if test "${with_gost+set}" = set; then :
   withval=$with_gost; with_gost="$withval"
@@ -17067,6 +17131,11 @@ else
 fi
 
 
+# EdDSA is not included in pairwise testing as it is not supported by
+# the SoftHSM version present in the relevant Docker image.
+#
+# [pairwise: skip]
+
 # Check whether --with-eddsa was given.
 if test "${with_eddsa+set}" = set; then :
   withval=$with_eddsa; with_eddsa="$withval"
@@ -17075,6 +17144,8 @@ else
 fi
 
 
+# [pairwise: --with-aes, --without-aes]
+
 # Check whether --with-aes was given.
 if test "${with_aes+set}" = set; then :
   withval=$with_aes; with_aes="$withval"
@@ -17086,6 +17157,7 @@ fi
 #
 # was --enable-openssl-hash specified?
 #
+# [pairwise: skip]
 # Check whether --enable-openssl-hash was given.
 if test "${enable_openssl_hash+set}" = set; then :
   enableval=$enable_openssl_hash; want_openssl_hash="$enableval"
@@ -17810,6 +17882,7 @@ fi
 #
 # Choose Client Cookie algorithm
 #
+# [pairwise: skip]
 
 # Check whether --with-cc-alg was given.
 if test "${with_cc_alg+set}" = set; then :
@@ -18218,6 +18291,8 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb library" >&5
 $as_echo_n "checking for lmdb library... " >&6; }
 
+# [pairwise: --with-lmdb=auto, --with-lmdb=yes, --without-lmdb]
+
 # Check whether --with-lmdb was given.
 if test "${with_lmdb+set}" = set; then :
   withval=$with_lmdb; use_lmdb="$withval"
@@ -18348,6 +18423,7 @@ fi
 #
 # was --with-libxml2 specified?
 #
+# [pairwise: --with-libxml2=auto, --with-libxml2=yes, --without-libxml2]
 
 # Check whether --with-libxml2 was given.
 if test "${with_libxml2+set}" = set; then :
@@ -18365,8 +18441,8 @@ case $with_libxml2 in #(
   auto) :
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libxml-2.0 >= 2.6.0" >&5
-$as_echo_n "checking for libxml-2.0 >= 2.6.0... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBXML2" >&5
+$as_echo_n "checking for LIBXML2... " >&6; }
 
 if test -n "$LIBXML2_CFLAGS"; then
     pkg_cv_LIBXML2_CFLAGS="$LIBXML2_CFLAGS"
@@ -18406,7 +18482,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -18424,7 +18500,7 @@ fi
 
 	:
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	:
 else
@@ -18437,8 +18513,8 @@ fi ;; #(
   yes) :
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libxml-2.0 >= 2.6.0" >&5
-$as_echo_n "checking for libxml-2.0 >= 2.6.0... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBXML2" >&5
+$as_echo_n "checking for LIBXML2... " >&6; }
 
 if test -n "$LIBXML2_CFLAGS"; then
     pkg_cv_LIBXML2_CFLAGS="$LIBXML2_CFLAGS"
@@ -18478,7 +18554,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -18505,7 +18581,7 @@ Alternatively, you may set the environment variables LIBXML2_CFLAGS
 and LIBXML2_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -18579,6 +18655,8 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for json library" >&5
 $as_echo_n "checking for json library... " >&6; }
 
+# [pairwise: --with-libjson=auto, --with-libjson=yes, --without-libjson]
+
 # Check whether --with-libjson was given.
 if test "${with_libjson+set}" = set; then :
   withval=$with_libjson; use_libjson="$withval"
@@ -18727,6 +18805,8 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for zlib library" >&5
 $as_echo_n "checking for zlib library... " >&6; }
 
+# [pairwise: --with-zlib=auto, --with-zlib=yes, --without-zlib]
+
 # Check whether --with-zlib was given.
 if test "${with_zlib+set}" = set; then :
   withval=$with_zlib; with_zlib="$withval"
@@ -18936,6 +19016,7 @@ fi
 #
 # Large File
 #
+# [pairwise: --enable-largefile, --disable-largefile]
 # Check whether --enable-largefile was given.
 if test "${enable_largefile+set}" = set; then :
   enableval=$enable_largefile; want_largefile="yes"
@@ -19225,6 +19306,11 @@ esac
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to use purify" >&5
 $as_echo_n "checking whether to use purify... " >&6; }
 
+# Purify is not included in pairwise testing as that tool is not present
+# in the relevant Docker image.
+#
+# [pairwise: skip]
+
 # Check whether --with-purify was given.
 if test "${with_purify+set}" = set; then :
   withval=$with_purify; use_purify="$withval"
@@ -19315,6 +19401,12 @@ esac
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to use gperftools profiler" >&5
 $as_echo_n "checking whether to use gperftools profiler... " >&6; }
 
+# Google/Great Performance Tools CPU Profiler is not included in
+# pairwise testing as that tool is not present in the relevant Docker
+# image.
+#
+# [pairwise: skip]
+
 # Check whether --with-gperftools-profiler was given.
 if test "${with_gperftools_profiler+set}" = set; then :
   withval=$with_gperftools_profiler; use_profiler="$withval"
@@ -19342,6 +19434,7 @@ esac
 # enable/disable dumping stack backtrace.  Also check if the system supports
 # glibc-compatible backtrace() function.
 #
+# [pairwise: --enable-backtrace, --disable-backtrace]
 # Check whether --enable-backtrace was given.
 if test "${enable_backtrace+set}" = set; then :
   enableval=$enable_backtrace; want_backtrace="$enableval"
@@ -19377,6 +19470,7 @@ rm -f core conftest.err conftest.$ac_objext \
 esac
 
 
+# [pairwise: --enable-symtable, --disable-symtable]
 # Check whether --enable-symtable was given.
 if test "${enable_symtable+set}" = set; then :
   enableval=$enable_symtable; want_symtable="$enableval"
@@ -19449,6 +19543,7 @@ BIND9_CO_RULE=".c.$O:"
 #
 # IPv6
 #
+# [pairwise: --enable-ipv6, --disable-ipv6]
 # Check whether --enable-ipv6 was given.
 if test "${enable_ipv6+set}" = set; then :
   enableval=$enable_ipv6;
@@ -19502,6 +19597,11 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Kame IPv6 support" >&5
 $as_echo_n "checking for Kame IPv6 support... " >&6; }
 
+# Kame is not included in pairwise testing as it is not present in the
+# relevant Docker image.
+#
+# [pairwise: skip]
+
 # Check whether --with-kame was given.
 if test "${with_kame+set}" = set; then :
   withval=$with_kame; use_kame="$withval"
@@ -20071,7 +20171,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 # confusing results on some systems (e.g. FreeBSD; see set_tcp_fastopen()
 # comment in lib/isc/unix/socket.c).
 #
-
+# [pairwise: --enable-tcp-fastopen, --disable-tcp-fastopen]
 # Check whether --enable-tcp_fastopen was given.
 if test "${enable_tcp_fastopen+set}" = set; then :
   enableval=$enable_tcp_fastopen;
@@ -20532,6 +20632,7 @@ fi
 
 
 
+# [pairwise: --enable-getifaddrs, --disable-getifaddrs]
 # Check whether --enable-getifaddrs was given.
 if test "${enable_getifaddrs+set}" = set; then :
   enableval=$enable_getifaddrs; want_getifaddrs="$enableval"
@@ -20691,6 +20792,8 @@ fi
 
 
 
+# [pairwise: --with-readline=auto, --with-readline=yes, --without-readline]
+
 # Check whether --with-readline was given.
 if test "${with_readline+set}" = set; then :
   withval=$with_readline; use_readline="$withval"
@@ -20940,6 +21043,7 @@ fi
 #
 # Use our own SPNEGO implementation?
 #
+# [pairwise: --enable-isc-spnego, --disable-isc-spnego]
 # Check whether --enable-isc-spnego was given.
 if test "${enable_isc_spnego+set}" = set; then :
   enableval=$enable_isc_spnego;
@@ -20973,6 +21077,8 @@ fi
 #
 # Note it is very recommended to *not* disable chroot(),
 # this is only because chroot() was made obsolete by Posix.
+#
+# [pairwise: --enable-chroot, --disable-chroot]
 # Check whether --enable-chroot was given.
 if test "${enable_chroot+set}" = set; then :
   enableval=$enable_chroot;
@@ -20995,6 +21101,8 @@ done
 	no)
 		;;
 esac
+
+# [pairwise: --enable-linux-caps, --disable-linux-caps]
 # Check whether --enable-linux-caps was given.
 if test "${enable_linux_caps+set}" = set; then :
   enableval=$enable_linux_caps;
@@ -21233,6 +21341,8 @@ $as_echo_n "checking type of rlim_cur... " >&6; }
 if test "$cross_compiling" = yes; then :
 
 
+# [pairwise: skip]
+
 # Check whether --with-rlimtype was given.
 if test "${with_rlimtype+set}" = set; then :
   withval=$with_rlimtype; rlimtype="$withval"
@@ -21641,6 +21751,7 @@ $as_echo "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
+# [pairwise: --enable-atomic, --disable-atomic]
 # Check whether --enable-atomic was given.
 if test "${enable_atomic+set}" = set; then :
   enableval=$enable_atomic; enable_atomic="$enableval"
@@ -22244,6 +22355,7 @@ fi
 #
 # Activate "rrset-order fixed" or not?
 #
+# [pairwise: --enable-fixed-rrset, --disable-fixed-rrset]
 # Check whether --enable-fixed-rrset was given.
 if test "${enable_fixed_rrset+set}" = set; then :
   enableval=$enable_fixed_rrset; enable_fixed="$enableval"
@@ -22266,6 +22378,7 @@ esac
 #
 # Enable response policy rewriting using NS IP addresses
 #
+# [pairwise: --enable-rpz-nsip, --disable-rpz-nsip]
 # Check whether --enable-rpz-nsip was given.
 if test "${enable_rpz_nsip+set}" = set; then :
   enableval=$enable_rpz_nsip; enable_nsip="$enableval"
@@ -22288,6 +22401,7 @@ esac
 #
 # Enable response policy rewriting using NS name
 #
+# [pairwise: --enable-rpz-nsdname, --disable-rpz-nsdname]
 # Check whether --enable-rpz-nsdname was given.
 if test "${enable_rpz_nsdname+set}" = set; then :
   enableval=$enable_rpz_nsdname; enable_nsdname="$enableval"
@@ -22310,6 +22424,7 @@ esac
 #
 # Activate "filter-aaaa-on-v4/v6" or not?
 #
+# [pairwise: --enable-filter-aaaa, --disable-filter-aaaa]
 # Check whether --enable-filter-aaaa was given.
 if test "${enable_filter_aaaa+set}" = set; then :
   enableval=$enable_filter_aaaa; enable_filter="$enableval"
@@ -22332,6 +22447,7 @@ esac
 #
 # Activate dnstap?
 #
+# [pairwise: --enable-dnstap, --disable-dnstap]
 # Check whether --enable-dnstap was given.
 if test "${enable_dnstap+set}" = set; then :
   enableval=$enable_dnstap; use_dnstap=$enableval
@@ -22349,6 +22465,8 @@ if test "x$use_dnstap" != "xno"; then
 		as_fn_error $? "Dnstap requires threads." "$LINENO" 5
 	fi
 
+	# [pairwise: skip]
+
 # Check whether --with-protobuf-c was given.
 if test "${with_protobuf_c+set}" = set; then :
   withval=$with_protobuf_c;
@@ -22463,6 +22581,8 @@ fi
 		as_fn_error $? "The protoc-c program was not found." "$LINENO" 5
 	fi
 
+	# [pairwise: skip]
+
 # Check whether --with-libfstrm was given.
 if test "${with_libfstrm+set}" = set; then :
   withval=$with_libfstrm;
@@ -23182,6 +23302,8 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Docbook-XSL path" >&5
 $as_echo_n "checking for Docbook-XSL path... " >&6; }
 
+# [pairwise: skip]
+
 # Check whether --with-docbook-xsl was given.
 if test "${with_docbook_xsl+set}" = set; then :
   withval=$with_docbook_xsl; docbook_path="$withval"
@@ -23417,6 +23539,10 @@ fi
 #
 # IDN support using idnkit
 #
+# idnkit is not included in pairwise testing as it is not present in the
+# relevant Docker image.
+#
+# [pairwise: skip]
 
 # Check whether --with-idnkit was given.
 if test "${with_idnkit+set}" = set; then :
@@ -23443,6 +23569,8 @@ esac
 iconvinc=
 iconvlib=
 
+# [pairwise: --with-libiconv, --without-libiconv]
+
 # Check whether --with-libiconv was given.
 if test "${with_libiconv+set}" = set; then :
   withval=$with_libiconv; use_libiconv="$withval"
@@ -23466,6 +23594,7 @@ no)
 	;;
 esac
 
+# [pairwise: --with-iconv, --without-iconv]
 
 # Check whether --with-iconv was given.
 if test "${with_iconv+set}" = set; then :
@@ -23481,6 +23610,7 @@ yes)
 	;;
 esac
 
+# [pairwise: skip]
 
 # Check whether --with-idnlib was given.
 if test "${with_idnlib+set}" = set; then :
@@ -23515,6 +23645,8 @@ LIBIDN2_CFLAGS=
 LIBIDN2_LDFLAGS=
 LIBIDN2_LIBS=
 
+# [pairwise: --with-libidn2=yes, --without-libidn2]
+
 # Check whether --with-libidn2 was given.
 if test "${with_libidn2+set}" = set; then :
   withval=$with_libidn2; use_libidn2="$withval"
@@ -23660,7 +23792,7 @@ fi
 #
 # Check whether to build with cmocka unit testing framework
 #
-
+# [pairwise: --with-cmocka, --without-cmocka]
 
 # Check whether --with-cmocka was given.
 if test "${with_cmocka+set}" = set; then :
@@ -23677,8 +23809,8 @@ case $with_cmocka in #(
 
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for cmocka >= 1.0.0" >&5
-$as_echo_n "checking for cmocka >= 1.0.0... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CMOCKA" >&5
+$as_echo_n "checking for CMOCKA... " >&6; }
 
 if test -n "$CMOCKA_CFLAGS"; then
     pkg_cv_CMOCKA_CFLAGS="$CMOCKA_CFLAGS"
@@ -23718,7 +23850,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -23745,7 +23877,7 @@ Alternatively, you may set the environment variables CMOCKA_CFLAGS
 and CMOCKA_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -23996,6 +24128,7 @@ done
 #
 # was --with-tuning specified?
 #
+# [pairwise: --with-tuning=large, --without-tuning]
 
 # Check whether --with-tuning was given.
 if test "${with_tuning+set}" = set; then :
@@ -24028,6 +24161,7 @@ esac
 #
 # was --enable-querytrace specified?
 #
+# [pairwise: --enable-querytrace, --disable-querytrace]
 # Check whether --enable-querytrace was given.
 if test "${enable_querytrace+set}" = set; then :
   enableval=$enable_querytrace; want_querytrace="$enableval"
@@ -24187,6 +24321,7 @@ SO_LD=""
 SO_TARGETS=""
 SO_STRIP="cat"
 
+# [pairwise: skip]
 
 # Check whether --with-dlopen was given.
 if test "${with_dlopen+set}" = set; then :
@@ -27200,7 +27335,6 @@ $as_echo "$as_me: executing $ac_file commands" >&6;}
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
@@ -27771,6 +27905,7 @@ fi
 #
 # Now that the Makefiles exist we can ensure that everything is rebuilt.
 #
+# [pairwise: --with-make-clean, --without-make-clean]
 
 # Check whether --with-make-clean was given.
 if test "${with_make_clean+set}" = set; then :
@@ -27793,6 +27928,7 @@ yes)
 	;;
 esac
 
+# [pairwise: --enable-full-report, --disable-full-report]
 # Check whether --enable-full-report was given.
 if test "${enable_full_report+set}" = set; then :
   enableval=$enable_full_report;
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index ec5293baad..e3f9aef95c 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -629,7 +629,7 @@ valcreate(fetchctx_t *fctx, dns_message_t *rmessage,
 
 	valarg->fctx = fctx;
 	valarg->addrinfo = addrinfo;
-	valarg->rmessage = rmessage;
+	dns_message_attach(rmessage, &valarg->rmessage);
 
 	if (!ISC_LIST_EMPTY(fctx->validators))
 		valoptions |= DNS_VALIDATOR_DEFER;
@@ -647,8 +647,10 @@ valcreate(fetchctx_t *fctx, dns_message_t *rmessage,
 			fctx->validator = validator;
 		}
 		ISC_LIST_APPEND(fctx->validators, validator, link);
-	} else
+	} else {
+		dns_message_detach(&valarg->rmessage);
 		isc_mem_put(fctx->mctx, valarg, sizeof(*valarg));
+	}
 	return (result);
 }
 
@@ -1004,7 +1006,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 			    ISFORWARDER(query->addrinfo))
 			{
 				add_bad(fctx, query->rmessage,
-				        query->addrinfo, ISC_R_TIMEDOUT,
+					query->addrinfo, ISC_R_TIMEDOUT,
 					badns_forwarder);
 			}
 
@@ -1736,7 +1738,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	}
 	query->rmessage = NULL;
 	result = dns_message_create(fctx->mctx, DNS_MESSAGE_INTENTPARSE,
-                                   &query->rmessage);
+				   &query->rmessage);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_query;
 	}
@@ -4897,7 +4899,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	uint32_t ttl;
 	unsigned options;
 	uint32_t bucketnum;
-	dns_message_t *rmessage;
+	dns_message_t *rmessage = NULL;
 
 	UNUSED(task); /* for now */
 
@@ -4908,7 +4910,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	res = fctx->res;
 	addrinfo = valarg->addrinfo;
 	REQUIRE(!ISC_LIST_EMPTY(fctx->validators));
-	rmessage = valarg->rmessage;
+	dns_message_attach(valarg->rmessage, &rmessage);
 
 	vevent = (dns_validatorevent_t *)event;
 	fctx->vresult = vevent->result;
@@ -4927,6 +4929,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	 * destroy the fctx if necessary.
 	 */
 	dns_validator_destroy(&vevent->validator);
+	dns_message_detach(&valarg->rmessage);
 	isc_mem_put(fctx->mctx, valarg, sizeof(*valarg));
 
 	negative = (vevent->rdataset == NULL);
@@ -5065,9 +5068,10 @@ validated(isc_task_t *task, isc_event_t *event) {
 				dns_resolver_addbadcache(res, &fctx->name,
 							 fctx->type, &expire);
 			fctx_done(fctx, result, __LINE__); /* Locks bucket. */
-		} else
+		} else {
 			fctx_try(fctx, true, true); /* Locks bucket. */
-		return;
+		}
+		goto cleanup_rmessage;
 	}
 
 
@@ -5287,6 +5291,8 @@ validated(isc_task_t *task, isc_event_t *event) {
  cleanup_event:
 	INSIST(node == NULL);
 	isc_event_free(&event);
+ cleanup_rmessage:
+	dns_message_detach(&rmessage);
 }
 
 static void
@@ -6274,9 +6280,6 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
 		}
 	}
 
-	dns_message_detach(&chkarg->rmessage);
-	isc_mem_put(fctx->mctx, chkarg, sizeof(*chkarg));
-
 	return (ISC_R_SUCCESS);
 }
 
@@ -6318,15 +6321,13 @@ chase_additional(fetchctx_t *fctx, dns_message_t *rmessage) {
 		     rdataset != NULL;
 		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
 			if (CHASE(rdataset)) {
-				dns_chkarg_t *chkarg;
-				chkarg = isc_mem_get(fctx->mctx,
-						     sizeof(*chkarg));
-				chkarg->fctx = fctx;
-				dns_message_attach(rmessage, &chkarg->rmessage);
+				dns_chkarg_t chkarg;
+				chkarg.fctx = fctx;
+				chkarg.rmessage = rmessage;
 				rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
 				(void)dns_rdataset_additionaldata(rdataset,
 								  check_related,
-								  chkarg);
+								  &chkarg);
 				rescan = true;
 			}
 		}
@@ -6928,7 +6929,7 @@ noanswer_response(fetchctx_t *fctx, dns_message_t *message,
 	 * we're not following a chain.)
 	 */
 	if (!negative_response && ns_name != NULL && oqname == NULL) {
-		dns_chkarg_t *chkarg;
+		dns_chkarg_t chkarg;
 		/*
 		 * We already know ns_name is a subdomain of fctx->domain.
 		 * If ns_name is equal to fctx->domain, we're not making
@@ -6958,12 +6959,10 @@ noanswer_response(fetchctx_t *fctx, dns_message_t *message,
 		 */
 		INSIST(ns_rdataset != NULL);
 		FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING);
-		chkarg = isc_mem_get(fctx->mctx,
-				     sizeof(*chkarg));
-		chkarg->fctx = fctx;
-		dns_message_attach(message, &chkarg->rmessage);
+		chkarg.fctx = fctx;
+		chkarg.rmessage = message;
 		(void)dns_rdataset_additionaldata(ns_rdataset, check_related,
-						  chkarg);
+						  &chkarg);
 #if CHECK_FOR_GLUE_IN_ANSWER
 		/*
 		 * Look in the answer section for "glue" that is incorrectly
@@ -6975,12 +6974,11 @@ noanswer_response(fetchctx_t *fctx, dns_message_t *message,
 		if ((look_in_options & LOOK_FOR_GLUE_IN_ANSWER) != 0 &&
 		    (fctx->type == dns_rdatatype_aaaa ||
 		     fctx->type == dns_rdatatype_a)) {
-			dns_chkarg_t *chkarg;
-			chkarg = isc_mem_get(fctx->mctx, sizeof(*chkarg));
-			chkarg->fctx = fctx;
-			dns_message_attach(message, &chkarg->rmessage);
+			dns_chkarg_t chkarg;
+			chkarg.fcx = fctx;
+			chkarg.rmessage = message;
 			(void)dns_rdataset_additionaldata(ns_rdataset,
-							  check_answer, chkarg);
+							  check_answer, &chkarg);
 		}
 #endif
 		FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING);
@@ -7182,7 +7180,7 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 		     rdataset != NULL;
 		     rdataset = ISC_LIST_NEXT(rdataset, link))
 		{
-			dns_chkarg_t *chkarg;
+			dns_chkarg_t chkarg;
 			if (!validinanswer(rdataset, fctx)) {
 				return (DNS_R_FORMERR);
 			}
@@ -7211,16 +7209,14 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 			rdataset->attributes |= DNS_RDATASETATTR_CACHE;
 			rdataset->trust = trust;
 			rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
-			chkarg = isc_mem_get(fctx->mctx,
-					     sizeof(*chkarg));
-			chkarg->fctx = fctx;
-			dns_message_attach(message, &chkarg->rmessage);
+			chkarg.fctx = fctx;
+			chkarg.rmessage = message;
 			(void)dns_rdataset_additionaldata(rdataset,
 							  check_related,
-							  chkarg);
+							  &chkarg);
 		}
 	} else if (aname != NULL) {
-		dns_chkarg_t *chkarg;
+		dns_chkarg_t chkarg;
 		if (!validinanswer(ardataset, fctx))
 			return (DNS_R_FORMERR);
 		if ((ardataset->type == dns_rdatatype_a ||
@@ -7242,12 +7238,10 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 		ardataset->attributes |= DNS_RDATASETATTR_ANSWER;
 		ardataset->attributes |= DNS_RDATASETATTR_CACHE;
 		ardataset->trust = trust;
-		chkarg = isc_mem_get(fctx->mctx,
-				     sizeof(*chkarg));
-		chkarg->fctx = fctx;
-		dns_message_attach(message, &chkarg->rmessage);
+		chkarg.fctx = fctx;
+		chkarg.rmessage = message;
 		(void)dns_rdataset_additionaldata(ardataset, check_related,
-						  chkarg);
+						  &chkarg);
 		for (sigrdataset = ISC_LIST_HEAD(aname->list);
 		     sigrdataset != NULL;
 		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
@@ -7385,7 +7379,7 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 				if (rdataset->type == dns_rdatatype_ns ||
 				    (rdataset->type == dns_rdatatype_rrsig &&
 				     rdataset->covers == dns_rdatatype_ns)) {
-					dns_chkarg_t *chkarg;
+					dns_chkarg_t chkarg;
 					name->attributes |=
 						DNS_NAMEATTR_CACHE;
 					rdataset->attributes |=
@@ -7407,15 +7401,12 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) {
 					 * Mark any additional data related
 					 * to this rdataset.
 					 */
-					chkarg = isc_mem_get(fctx->mctx,
-							     sizeof(*chkarg));
-					chkarg->fctx = fctx;
-					dns_message_attach(message,
-							   &chkarg->rmessage);
+					chkarg.fctx = fctx;
+					chkarg.rmessage = message;
 					(void)dns_rdataset_additionaldata(
 							rdataset,
 							check_related,
-							chkarg);
+							&chkarg);
 					done = true;
 				}
 			}
@@ -7835,7 +7826,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	dns_dispatchevent_t *devent = (dns_dispatchevent_t *)event;
 	bool keep_trying, get_nameservers, resend, nextitem;
 	bool truncated;
-	dns_message_t *message;
+	dns_message_t *rmessage = NULL;
 	dns_rdataset_t *opt;
 	fetchctx_t *fctx;
 	dns_name_t *fname;
@@ -7866,6 +7857,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	options = query->options;
 	REQUIRE(VALID_FCTX(fctx));
 	REQUIRE(event->ev_type == DNS_EVENT_DISPATCH);
+	dns_message_attach(query->rmessage, &rmessage);
 
 	QTRACE("response");
 
@@ -7947,10 +7939,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		goto done;
 	}
 
-	message = query->rmessage;
-
 	if (query->tsig != NULL) {
-		result = dns_message_setquerytsig(message, query->tsig);
+		result = dns_message_setquerytsig(rmessage, query->tsig);
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE3("unable to set query tsig", result);
 			goto done;
@@ -7958,14 +7948,14 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (query->tsigkey) {
-		result = dns_message_settsigkey(message, query->tsigkey);
+		result = dns_message_settsigkey(rmessage, query->tsigkey);
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE3("unable to set tsig key", result);
 			goto done;
 		}
 	}
 
-	dns_message_setclass(message, res->rdclass);
+	dns_message_setclass(rmessage, res->rdclass);
 
 	if ((options & DNS_FETCHOPT_TCP) == 0) {
 		if ((options & DNS_FETCHOPT_NOEDNS0) == 0)
@@ -7974,16 +7964,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		else
 			dns_adb_plainresponse(fctx->adb, query->addrinfo);
 	}
-	result = dns_message_parse(message, &devent->buffer, 0);
+	result = dns_message_parse(rmessage, &devent->buffer, 0);
 	if (result != ISC_R_SUCCESS) {
 		FCTXTRACE3("message failed to parse", result);
 		switch (result) {
 		case ISC_R_UNEXPECTEDEND:
-			if (!message->question_ok ||
-			    (message->flags & DNS_MESSAGEFLAG_TC) == 0 ||
+			if (!rmessage->question_ok ||
+			    (rmessage->flags & DNS_MESSAGEFLAG_TC) == 0 ||
 			    (options & DNS_FETCHOPT_TCP) != 0) {
 				/*
-				 * Either the message ended prematurely,
+				 * Either the rmessage ended prematurely,
 				 * and/or wasn't marked as being truncated,
 				 * and/or this is a response to a query we
 				 * sent over TCP.  In all of these cases,
@@ -8012,7 +8002,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			}
 			/*
 			 * We defer retrying via TCP for a bit so we can
-			 * check out this message further.
+			 * check out this rmessage further.
 			 */
 			truncated = true;
 			break;
@@ -8043,7 +8033,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Log the incoming packet.
 	 */
-	dns_message_logfmtpacket2(message, "received packet from",
+	dns_message_logfmtpacket2(rmessage, "received packet from",
 				  &query->addrinfo->sockaddr,
 				  DNS_LOGCATEGORY_RESOLVER,
 				  DNS_LOGMODULE_PACKETS,
@@ -8089,7 +8079,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		    &zr, &query->start, NULL, &devent->buffer);
 #endif /* HAVE_DNSTAP */
 
-	if (message->rdclass != res->rdclass) {
+	if (rmessage->rdclass != res->rdclass) {
 		resend = true;
 		FCTXTRACE("bad class");
 		goto done;
@@ -8098,11 +8088,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Process receive opt record.
 	 */
-	opt = dns_message_getopt(message);
+	opt = dns_message_getopt(rmessage);
 	if (opt != NULL)
 		process_opt(query, opt);
 
-	if (message->cc_bad && (options & DNS_FETCHOPT_TCP) == 0) {
+	if (rmessage->cc_bad && (options & DNS_FETCHOPT_TCP) == 0) {
 		/*
 		 * If the COOKIE is bad, assume it is an attack and
 		 * keep listening for a good answer.
@@ -8125,10 +8115,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * the same question.
 	 * FORMERR/NOTIMP if they have a question section then it must match.
 	 */
-	switch (message->rcode) {
+	switch (rmessage->rcode) {
 	case dns_rcode_notimp:
 	case dns_rcode_formerr:
-		if (message->counts[DNS_SECTION_QUESTION] == 0)
+		if (rmessage->counts[DNS_SECTION_QUESTION] == 0)
 			break;
 		/* FALLTHROUGH */
 	case dns_rcode_nxrrset:	/* Not expected. */
@@ -8139,7 +8129,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	case dns_rcode_refused:
 	case dns_rcode_servfail:
 	default:
-		result = same_question(fctx, message);
+		result = same_question(fctx, rmessage);
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE3("response did not match question", result);
 			nextitem = true;
@@ -8149,10 +8139,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * If the message is signed, check the signature.  If not, this
+	 * If the rmessage is signed, check the signature.  If not, this
 	 * returns success anyway.
 	 */
-	result = dns_message_checksig(message, res->view);
+	result = dns_message_checksig(rmessage, res->view);
 	if (result != ISC_R_SUCCESS) {
 		FCTXTRACE3("signature check failed", result);
 		goto done;
@@ -8161,12 +8151,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * The dispatcher should ensure we only get responses with QR set.
 	 */
-	INSIST((message->flags & DNS_MESSAGEFLAG_QR) != 0);
+	INSIST((rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
 	/*
-	 * INSIST() that the message comes from the place we sent it to,
+	 * INSIST() that the rmessage comes from the place we sent it to,
 	 * since the dispatch code should ensure this.
 	 *
-	 * INSIST() that the message id is correct (this should also be
+	 * INSIST() that the rmessage id is correct (this should also be
 	 * ensured by the dispatch code).
 	 */
 
@@ -8177,12 +8167,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * EDNS support.
 	 */
 	if (opt == NULL && !EDNSOK(query->addrinfo) &&
-	    (message->rcode == dns_rcode_noerror ||
-	     message->rcode == dns_rcode_nxdomain ||
-	     message->rcode == dns_rcode_refused ||
-	     message->rcode == dns_rcode_yxdomain) &&
+	    (rmessage->rcode == dns_rcode_noerror ||
+	     rmessage->rcode == dns_rcode_nxdomain ||
+	     rmessage->rcode == dns_rcode_refused ||
+	     rmessage->rcode == dns_rcode_yxdomain) &&
 	     bad_edns(fctx, &query->addrinfo->sockaddr)) {
-		dns_message_logpacket2(message,
+		dns_message_logpacket2(rmessage,
 				       "received packet (bad edns) from",
 				       &query->addrinfo->sockaddr,
 				       DNS_LOGCATEGORY_RESOLVER,
@@ -8192,10 +8182,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
 				    DNS_FETCHOPT_NOEDNS0,
 				    DNS_FETCHOPT_NOEDNS0);
-	} else if (opt == NULL && (message->flags & DNS_MESSAGEFLAG_TC) == 0 &&
+	} else if (opt == NULL && (rmessage->flags & DNS_MESSAGEFLAG_TC) == 0 &&
 		   !EDNSOK(query->addrinfo) &&
-		   (message->rcode == dns_rcode_noerror ||
-		    message->rcode == dns_rcode_nxdomain) &&
+		   (rmessage->rcode == dns_rcode_noerror ||
+		    rmessage->rcode == dns_rcode_nxdomain) &&
 		   (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 		/*
 		 * We didn't get a OPT record in response to a EDNS query.
@@ -8208,7 +8198,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 * should be safe to do for any rcode we limit it to NOERROR
 		 * and NXDOMAIN.
 		 */
-		dns_message_logpacket2(message, "received packet (no opt) from",
+		dns_message_logpacket2(rmessage, "received packet (no opt) from",
 				       &query->addrinfo->sockaddr,
 				       DNS_LOGCATEGORY_RESOLVER,
 				       DNS_LOGMODULE_RESOLVER,
@@ -8224,10 +8214,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (opt != NULL && !EDNSOK(query->addrinfo) &&
 	    (query->options & DNS_FETCHOPT_NOEDNS0) == 0 &&
-	    (message->rcode == dns_rcode_noerror ||
-	     message->rcode == dns_rcode_nxdomain ||
-	     message->rcode == dns_rcode_refused ||
-	     message->rcode == dns_rcode_yxdomain)) {
+	    (rmessage->rcode == dns_rcode_noerror ||
+	     rmessage->rcode == dns_rcode_nxdomain ||
+	     rmessage->rcode == dns_rcode_refused ||
+	     rmessage->rcode == dns_rcode_yxdomain)) {
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
 				    FCTX_ADDRINFO_EDNSOK,
 				    FCTX_ADDRINFO_EDNSOK);
@@ -8236,7 +8226,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Deal with truncated responses by retrying using TCP.
 	 */
-	if ((message->flags & DNS_MESSAGEFLAG_TC) != 0)
+	if ((rmessage->flags & DNS_MESSAGEFLAG_TC) != 0)
 		truncated = true;
 
 	if (truncated) {
@@ -8255,19 +8245,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Is it a query response?
 	 */
-	if (message->opcode != dns_opcode_query) {
+	if (rmessage->opcode != dns_opcode_query) {
 		/* XXXRTH Log */
 		broken_server = DNS_R_UNEXPECTEDOPCODE;
 		keep_trying = true;
-		FCTXTRACE("invalid message opcode");
+		FCTXTRACE("invalid rmessage opcode");
 		goto done;
 	}
 
 	/*
 	 * Update statistics about erroneous responses.
 	 */
-	if (message->rcode != dns_rcode_noerror) {
-		switch (message->rcode) {
+	if (rmessage->rcode != dns_rcode_noerror) {
+		switch (rmessage->rcode) {
 		case dns_rcode_nxdomain:
 			inc_stats(res, dns_resstatscounter_nxdomain);
 			break;
@@ -8295,9 +8285,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Is the remote server broken, or does it dislike us?
 	 */
-	if (message->rcode != dns_rcode_noerror &&
-	    message->rcode != dns_rcode_yxdomain &&
-	    message->rcode != dns_rcode_nxdomain) {
+	if (rmessage->rcode != dns_rcode_noerror &&
+	    rmessage->rcode != dns_rcode_yxdomain &&
+	    rmessage->rcode != dns_rcode_nxdomain) {
 		isc_buffer_t b;
 		char code[64];
 		unsigned char cookie[64];
@@ -8306,19 +8296,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 * Some servers do not ignore unknown EDNS options.
 		 */
 		if (!NOCOOKIE(query->addrinfo) &&
-		    (message->rcode == dns_rcode_formerr ||
-		     message->rcode == dns_rcode_notimp ||
-		     message->rcode == dns_rcode_refused) &&
+		    (rmessage->rcode == dns_rcode_formerr ||
+		     rmessage->rcode == dns_rcode_notimp ||
+		     rmessage->rcode == dns_rcode_refused) &&
 		     dns_adb_getcookie(fctx->adb, query->addrinfo,
 				       cookie, sizeof(cookie)) == 0U) {
 			dns_adb_changeflags(fctx->adb, query->addrinfo,
 					    FCTX_ADDRINFO_NOCOOKIE,
 					    FCTX_ADDRINFO_NOCOOKIE);
 			resend = true;
-		} else if ((message->rcode == dns_rcode_formerr ||
-			    message->rcode == dns_rcode_notimp ||
-			    (message->rcode == dns_rcode_servfail &&
-			     dns_message_getopt(message) == NULL)) &&
+		} else if ((rmessage->rcode == dns_rcode_formerr ||
+			    rmessage->rcode == dns_rcode_notimp ||
+			    (rmessage->rcode == dns_rcode_servfail &&
+			     dns_message_getopt(rmessage) == NULL)) &&
 			   (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 			/*
 			 * It's very likely they don't like EDNS0.
@@ -8338,7 +8328,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 */
 			add_bad_edns(fctx, &query->addrinfo->sockaddr);
 			inc_stats(res, dns_resstatscounter_edns0fail);
-		} else if (message->rcode == dns_rcode_formerr) {
+		} else if (rmessage->rcode == dns_rcode_formerr) {
 			if (ISFORWARDER(query->addrinfo)) {
 				/*
 				 * This forwarder doesn't understand us,
@@ -8358,7 +8348,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				log_formerr(fctx, "server sent FORMERR");
 				result = DNS_R_FORMERR;
 			}
-		} else if (message->rcode == dns_rcode_badvers) {
+		} else if (rmessage->rcode == dns_rcode_badvers) {
 			unsigned int version;
 			bool setnocookie = false;
 #if DNS_EDNS_VERSION > 0
@@ -8425,8 +8415,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				keep_trying = true;
 			}
 #endif
-		} else if (message->rcode == dns_rcode_badcookie &&
-			   message->cc_ok) {
+		} else if (rmessage->rcode == dns_rcode_badcookie &&
+			   rmessage->cc_ok) {
 			/*
 			 * We have recorded the new cookie.
 			 */
@@ -8444,7 +8434,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		}
 
 		isc_buffer_init(&b, code, sizeof(code) - 1);
-		dns_rcode_totext(message->rcode, &b);
+		dns_rcode_totext(rmessage->rcode, &b);
 		code[isc_buffer_usedlength(&b)] = '\0';
 		FCTXTRACE2("remote server broken: returned ", code);
 		goto done;
@@ -8454,7 +8444,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * Is the server lame?
 	 */
 	if (res->lame_ttl != 0 && !ISFORWARDER(query->addrinfo) &&
-	    is_lame(fctx, message)) {
+	    is_lame(fctx, rmessage)) {
 		inc_stats(res, dns_resstatscounter_lame);
 		log_lame(fctx, query->addrinfo);
 		result = dns_adb_marklame(fctx->adb, query->addrinfo,
@@ -8477,7 +8467,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	if (!ISFORWARDER(query->addrinfo) &&
 	    dns_view_isdelegationonly(res->view, &fctx->domain) &&
 	    !dns_name_equal(&fctx->domain, &fctx->name) &&
-	    fix_mustbedelegationornxdomain(message, fctx)) {
+	    fix_mustbedelegationornxdomain(rmessage, fctx)) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		char domainbuf[DNS_NAME_FORMATSIZE];
 		char addrbuf[ISC_SOCKADDR_FORMATSIZE];
@@ -8500,7 +8490,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if ((res->options & DNS_RESOLVER_CHECKNAMES) != 0)
-		checknames(message);
+		checknames(rmessage);
 
 	/*
 	 * Clear cache bits.
@@ -8510,22 +8500,22 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Did we get any answers?
 	 */
-	if (message->counts[DNS_SECTION_ANSWER] > 0 &&
-	    (message->rcode == dns_rcode_noerror ||
-	     message->rcode == dns_rcode_yxdomain ||
-	     message->rcode == dns_rcode_nxdomain)) {
+	if (rmessage->counts[DNS_SECTION_ANSWER] > 0 &&
+	    (rmessage->rcode == dns_rcode_noerror ||
+	     rmessage->rcode == dns_rcode_yxdomain ||
+	     rmessage->rcode == dns_rcode_nxdomain)) {
 		/*
 		 * [normal case]
 		 * We've got answers.  If it has an authoritative answer or an
 		 * answer from a forwarder, we're done.
 		 */
-		if ((message->flags & DNS_MESSAGEFLAG_AA) != 0 ||
+		if ((rmessage->flags & DNS_MESSAGEFLAG_AA) != 0 ||
 		    ISFORWARDER(query->addrinfo))
 		{
-			result = answer_response(fctx, message);
+			result = answer_response(fctx, rmessage);
 			if (result != ISC_R_SUCCESS)
 				FCTXTRACE3("answer_response (AA/fwd)", result);
-		} else if (iscname(fctx, message) &&
+		} else if (iscname(fctx, rmessage) &&
 			 fctx->type != dns_rdatatype_any &&
 			 fctx->type != dns_rdatatype_cname)
 		{
@@ -8534,16 +8524,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * answer when a CNAME is followed.  We should treat
 			 * it as a valid answer.
 			 */
-			result = answer_response(fctx, message);
+			result = answer_response(fctx, rmessage);
 			if (result != ISC_R_SUCCESS)
 				FCTXTRACE3("answer_response (!ANY/!CNAME)",
 					   result);
 		} else if (fctx->type != dns_rdatatype_ns &&
-			   !betterreferral(fctx, message)) {
+			   !betterreferral(fctx, rmessage)) {
 			/*
 			 * Lame response !!!.
 			 */
-			result = answer_response(fctx, message);
+			result = answer_response(fctx, rmessage);
 			if (result != ISC_R_SUCCESS)
 				FCTXTRACE3("answer_response (!NS)", result);
 		} else {
@@ -8557,7 +8547,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				 * special kludge to treat it as a referral.
 				 */
 				result = noanswer_response(fctx,
-							   message,
+							   rmessage,
 							   NULL,
 						  LOOK_FOR_NS_IN_ANSWER);
 				if (result != ISC_R_SUCCESS)
@@ -8577,7 +8567,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				 * such a corner case.
 				 */
 				result = noanswer_response(fctx,
-							   message,
+							   rmessage,
 							   NULL,
 						   LOOK_FOR_GLUE_IN_ANSWER);
 				if (result != ISC_R_SUCCESS)
@@ -8602,13 +8592,13 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				keep_trying = true;
 			goto done;
 		}
-	} else if (message->counts[DNS_SECTION_AUTHORITY] > 0 ||
-		   message->rcode == dns_rcode_noerror ||
-		   message->rcode == dns_rcode_nxdomain) {
+	} else if (rmessage->counts[DNS_SECTION_AUTHORITY] > 0 ||
+		   rmessage->rcode == dns_rcode_noerror ||
+		   rmessage->rcode == dns_rcode_nxdomain) {
 		/*
 		 * NXDOMAIN, NXRDATASET, or referral.
 		 */
-		result = noanswer_response(fctx, message, NULL, 0);
+		result = noanswer_response(fctx, rmessage, NULL, 0);
 		switch (result) {
 		case ISC_R_SUCCESS:
 		case DNS_R_CHASEDSSERVERS:
@@ -8664,14 +8654,14 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Follow additional section data chains.
 	 */
-	chase_additional(fctx, message);
+	chase_additional(fctx, rmessage);
 
 	/*
-	 * Cache the cacheable parts of the message.  This may also cause
+	 * Cache the cacheable parts of the rmessage.  This may also cause
 	 * work to be queued to the DNSSEC validator.
 	 */
 	if (WANTCACHE(fctx)) {
-		result = cache_message(fctx, message, query->addrinfo,
+		result = cache_message(fctx, rmessage, query->addrinfo,
 				       now);
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE3("cache_message complete", result);
@@ -8680,7 +8670,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * Ncache the negatively cacheable parts of the message.  This may
+	 * Ncache the negatively cacheable parts of the rmessage.  This may
 	 * also cause work to be queued to the DNSSEC validator.
 	 */
 	if (WANTNCACHE(fctx)) {
@@ -8689,16 +8679,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * Cache DS NXDOMAIN separately to other types.
 		 */
-		if (message->rcode == dns_rcode_nxdomain &&
+		if (rmessage->rcode == dns_rcode_nxdomain &&
 		    fctx->type != dns_rdatatype_ds)
 			covers = dns_rdatatype_any;
 		else
 			covers = fctx->type;
 
 		/*
-		 * Cache any negative cache entries in the message.
+		 * Cache any negative cache entries in the rmessage.
 		 */
-		result = ncache_message(fctx, message, query->addrinfo, covers, now);
+		result = ncache_message(fctx, rmessage, query->addrinfo, covers, now);
 		if (result != ISC_R_SUCCESS)
 			FCTXTRACE3("ncache_message complete", result);
 	}
@@ -8726,7 +8716,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 #ifdef ENABLE_AFL
 	if (dns_fuzzing_resolver && (keep_trying || resend)) {
 		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-		return;
+		goto cleanup_rmessage;
 	} else
 #endif
 	if (keep_trying) {
@@ -8737,7 +8727,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * Add this server to the list of bad servers for
 			 * this fctx.
 			 */
-			add_bad(fctx, message, addrinfo,
+			add_bad(fctx, rmessage, addrinfo,
 				broken_server, broken_type);
 		}
 
@@ -8746,7 +8736,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			fname = dns_fixedname_initname(&foundname);
 			if (result != ISC_R_SUCCESS) {
 				fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-				return;
+				goto detach_rmessage;
 			}
 			findoptions = 0;
 			if (dns_rdatatype_atparent(fctx->type))
@@ -8764,7 +8754,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			if (result != ISC_R_SUCCESS) {
 				FCTXTRACE("couldn't find a zonecut");
 				fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-				return;
+				goto detach_rmessage;
 			}
 			if (!dns_name_issubdomain(fname, &fctx->domain)) {
 				/*
@@ -8773,7 +8763,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				 */
 				FCTXTRACE("nameservers now above QDOMAIN");
 				fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-				return;
+				goto detach_rmessage;
 			}
 
 			fcount_decr(fctx);
@@ -8782,12 +8772,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			result = dns_name_dup(fname, fctx->mctx, &fctx->domain);
 			if (result != ISC_R_SUCCESS) {
 				fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-				return;
+				goto detach_rmessage;
 			}
 			result = fcount_incr(fctx, true);
 			if (result != ISC_R_SUCCESS) {
 				fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-				return;
+				goto detach_rmessage;
 			}
 			fctx->ns_ttl = fctx->nameservers.ttl;
 			fctx->ns_ttl_ok = true;
@@ -8844,7 +8834,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			fctx_done(fctx, result, __LINE__);
 	} else if (result == DNS_R_CHASEDSSERVERS) {
 		unsigned int n;
-		add_bad(fctx, query->rmessage, addrinfo, result, broken_type);
+		add_bad(fctx, rmessage, addrinfo, result, broken_type);
 		fctx_cancelqueries(fctx, true, false);
 		fctx_cleanupfinds(fctx);
 		fctx_cleanupforwaddrs(fctx);
@@ -8875,6 +8865,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 */
 		fctx_done(fctx, result, __LINE__);
 	}
+detach_rmessage:
+	dns_message_detach(&rmessage);
 }
 
 /***
diff --git a/libtool.m4/libtool.m4 b/libtool.m4/libtool.m4
index a3bc337b79..c81e66920c 100644
--- a/libtool.m4/libtool.m4
+++ b/libtool.m4/libtool.m4
@@ -728,7 +728,6 @@ _LT_CONFIG_SAVE_COMMANDS([
     cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.
 
 # Provide generalized library-building support services.
@@ -2887,6 +2886,18 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -3546,7 +3557,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
   else
@@ -4052,7 +4063,8 @@ _LT_EOF
   if AC_TRY_EVAL(ac_compile); then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4424,7 +4436,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      netbsd*)
+      netbsd* | netbsdelf*-gnu)
 	;;
       *qnx* | *nto*)
         # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4936,6 +4948,9 @@ m4_if([$1], [CXX], [
       ;;
     esac
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   *)
     _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
     ;;
@@ -4998,6 +5013,9 @@ dnl Note also adjust exclude_expsyms for C++ above.
   openbsd* | bitrig*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   esac
 
   _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -5252,7 +5270,7 @@ _LT_EOF
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5773,6 +5791,7 @@ _LT_EOF
 	if test yes = "$lt_cv_irix_exported_symbol"; then
           _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	_LT_TAGVAR(link_all_deplibs, $1)=no
       else
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -5794,7 +5813,7 @@ _LT_EOF
       esac
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -6420,7 +6439,7 @@ if test yes != "$_lt_caught_CXX_error"; then
       # Commands to make compiler produce verbose output that lists
       # what "hidden" libraries, object files and flags are used when
       # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
     else
       GXX=no
@@ -6795,7 +6814,7 @@ if test yes != "$_lt_caught_CXX_error"; then
             # explicitly linking system object files so we need to strip them
             # from the output so that they don't get included in the library
             # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
             ;;
           *)
             if test yes = "$GXX"; then
@@ -6860,7 +6879,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
           *)
 	    if test yes = "$GXX"; then
@@ -7199,7 +7218,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 	    else
 	      # FIXME: insert proper C++ library support
@@ -7283,7 +7302,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7294,7 +7313,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi
 
 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
diff --git a/ltmain.sh b/ltmain.sh
index 0f0a2da3f9..c12c197be7 100644
--- a/ltmain.sh
+++ b/ltmain.sh
@@ -31,7 +31,7 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION=2.4.6
+VERSION="2.4.6 Debian-2.4.6-9"
 package_revision=2.4.6
 
 
@@ -1370,7 +1370,7 @@ func_lt_ver ()
 #! /bin/sh
 
 # Set a version string for this script.
-scriptversion=2014-01-07.03; # UTC
+scriptversion=2015-10-07.11; # UTC
 
 # A portable, pluggable option parser for Bourne shell.
 # Written by Gary V. Vaughan, 2010
@@ -1530,6 +1530,8 @@ func_run_hooks ()
 {
     $debug_cmd
 
+    _G_rc_run_hooks=false
+
     case " $hookable_fns " in
       *" $1 "*) ;;
       *) func_fatal_error "'$1' does not support hook funcions.n" ;;
@@ -1538,16 +1540,16 @@ func_run_hooks ()
     eval _G_hook_fns=\$$1_hooks; shift
 
     for _G_hook in $_G_hook_fns; do
-      eval $_G_hook '"$@"'
-
-      # store returned options list back into positional
-      # parameters for next 'cmd' execution.
-      eval _G_hook_result=\$${_G_hook}_result
-      eval set dummy "$_G_hook_result"; shift
+      if eval $_G_hook '"$@"'; then
+        # store returned options list back into positional
+        # parameters for next 'cmd' execution.
+        eval _G_hook_result=\$${_G_hook}_result
+        eval set dummy "$_G_hook_result"; shift
+        _G_rc_run_hooks=:
+      fi
     done
 
-    func_quote_for_eval ${1+"$@"}
-    func_run_hooks_result=$func_quote_for_eval_result
+    $_G_rc_run_hooks && func_run_hooks_result=$_G_hook_result
 }
 
 
@@ -1557,10 +1559,16 @@ func_run_hooks ()
 ## --------------- ##
 
 # In order to add your own option parsing hooks, you must accept the
-# full positional parameter list in your hook function, remove any
-# options that you action, and then pass back the remaining unprocessed
+# full positional parameter list in your hook function, you may remove/edit
+# any options that you action, and then pass back the remaining unprocessed
 # options in '<hooked_function_name>_result', escaped suitably for
-# 'eval'.  Like this:
+# 'eval'.  In this case you also must return $EXIT_SUCCESS to let the
+# hook's caller know that it should pay attention to
+# '<hooked_function_name>_result'.  Returning $EXIT_FAILURE signalizes that
+# arguments are left untouched by the hook and therefore caller will ignore the
+# result variable.
+#
+# Like this:
 #
 #    my_options_prep ()
 #    {
@@ -1570,9 +1578,11 @@ func_run_hooks ()
 #        usage_message=$usage_message'
 #      -s, --silent       don'\''t print informational messages
 #    '
-#
-#        func_quote_for_eval ${1+"$@"}
-#        my_options_prep_result=$func_quote_for_eval_result
+#        # No change in '$@' (ignored completely by this hook).  There is
+#        # no need to do the equivalent (but slower) action:
+#        # func_quote_for_eval ${1+"$@"}
+#        # my_options_prep_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_options_prep my_options_prep
 #
@@ -1581,25 +1591,37 @@ func_run_hooks ()
 #    {
 #        $debug_cmd
 #
+#        args_changed=false
+#
 #        # Note that for efficiency, we parse as many options as we can
 #        # recognise in a loop before passing the remainder back to the
 #        # caller on the first unrecognised argument we encounter.
 #        while test $# -gt 0; do
 #          opt=$1; shift
 #          case $opt in
-#            --silent|-s) opt_silent=: ;;
+#            --silent|-s) opt_silent=:
+#                         args_changed=:
+#                         ;;
 #            # Separate non-argument short options:
 #            -s*)         func_split_short_opt "$_G_opt"
 #                         set dummy "$func_split_short_opt_name" \
 #                             "-$func_split_short_opt_arg" ${1+"$@"}
 #                         shift
+#                         args_changed=:
 #                         ;;
-#            *)            set dummy "$_G_opt" "$*"; shift; break ;;
+#            *)           # Make sure the first unrecognised option "$_G_opt"
+#                         # is added back to "$@", we could need that later
+#                         # if $args_changed is true.
+#                         set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
 #          esac
 #        done
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_silent_option_result=$func_quote_for_eval_result
+#        if $args_changed; then
+#          func_quote_for_eval ${1+"$@"}
+#          my_silent_option_result=$func_quote_for_eval_result
+#        fi
+#
+#        $args_changed
 #    }
 #    func_add_hook func_parse_options my_silent_option
 #
@@ -1611,16 +1633,32 @@ func_run_hooks ()
 #        $opt_silent && $opt_verbose && func_fatal_help "\
 #    '--silent' and '--verbose' options are mutually exclusive."
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_option_validation_result=$func_quote_for_eval_result
+#        false
 #    }
 #    func_add_hook func_validate_options my_option_validation
 #
-# You'll alse need to manually amend $usage_message to reflect the extra
+# You'll also need to manually amend $usage_message to reflect the extra
 # options you parse.  It's preferable to append if you can, so that
 # multiple option parsing hooks can be added safely.
 
 
+# func_options_finish [ARG]...
+# ----------------------------
+# Finishing the option parse loop (call 'func_options' hooks ATM).
+func_options_finish ()
+{
+    $debug_cmd
+
+    _G_func_options_finish_exit=false
+    if func_run_hooks func_options ${1+"$@"}; then
+      func_options_finish_result=$func_run_hooks_result
+      _G_func_options_finish_exit=:
+    fi
+
+    $_G_func_options_finish_exit
+}
+
+
 # func_options [ARG]...
 # ---------------------
 # All the functions called inside func_options are hookable. See the
@@ -1630,17 +1668,28 @@ func_options ()
 {
     $debug_cmd
 
-    func_options_prep ${1+"$@"}
-    eval func_parse_options \
-        ${func_options_prep_result+"$func_options_prep_result"}
-    eval func_validate_options \
-        ${func_parse_options_result+"$func_parse_options_result"}
+    _G_rc_options=false
 
-    eval func_run_hooks func_options \
-        ${func_validate_options_result+"$func_validate_options_result"}
+    for my_func in options_prep parse_options validate_options options_finish
+    do
+      if eval func_$my_func '${1+"$@"}'; then
+        eval _G_res_var='$'"func_${my_func}_result"
+        eval set dummy "$_G_res_var" ; shift
+        _G_rc_options=:
+      fi
+    done
 
-    # save modified positional parameters for caller
-    func_options_result=$func_run_hooks_result
+    # Save modified positional parameters for caller.  As a top-level
+    # options-parser function we always need to set the 'func_options_result'
+    # variable (regardless the $_G_rc_options value).
+    if $_G_rc_options; then
+      func_options_result=$_G_res_var
+    else
+      func_quote_for_eval ${1+"$@"}
+      func_options_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_options
 }
 
 
@@ -1649,9 +1698,9 @@ func_options ()
 # All initialisations required before starting the option parse loop.
 # Note that when calling hook functions, we pass through the list of
 # positional parameters.  If a hook function modifies that list, and
-# needs to propogate that back to rest of this script, then the complete
+# needs to propagate that back to rest of this script, then the complete
 # modified list must be put in 'func_run_hooks_result' before
-# returning.
+# returning $EXIT_SUCCESS (otherwise $EXIT_FAILURE is returned).
 func_hookable func_options_prep
 func_options_prep ()
 {
@@ -1661,10 +1710,14 @@ func_options_prep ()
     opt_verbose=false
     opt_warning_types=
 
-    func_run_hooks func_options_prep ${1+"$@"}
+    _G_rc_options_prep=false
+    if func_run_hooks func_options_prep ${1+"$@"}; then
+      _G_rc_options_prep=:
+      # save modified positional parameters for caller
+      func_options_prep_result=$func_run_hooks_result
+    fi
 
-    # save modified positional parameters for caller
-    func_options_prep_result=$func_run_hooks_result
+    $_G_rc_options_prep
 }
 
 
@@ -1678,18 +1731,20 @@ func_parse_options ()
 
     func_parse_options_result=
 
+    _G_rc_parse_options=false
     # this just eases exit handling
     while test $# -gt 0; do
       # Defer to hook functions for initial option parsing, so they
       # get priority in the event of reusing an option name.
-      func_run_hooks func_parse_options ${1+"$@"}
-
-      # Adjust func_parse_options positional parameters to match
-      eval set dummy "$func_run_hooks_result"; shift
+      if func_run_hooks func_parse_options ${1+"$@"}; then
+        eval set dummy "$func_run_hooks_result"; shift
+        _G_rc_parse_options=:
+      fi
 
       # Break out of the loop if we already parsed every option.
       test $# -gt 0 || break
 
+      _G_match_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -1704,7 +1759,10 @@ func_parse_options ()
 		      ;;
 
         --warnings|--warning|-W)
-                      test $# = 0 && func_missing_arg $_G_opt && break
+                      if test $# = 0 && func_missing_arg $_G_opt; then
+                        _G_rc_parse_options=:
+                        break
+                      fi
                       case " $warning_categories $1" in
                         *" $1 "*)
                           # trailing space prevents matching last $1 above
@@ -1757,15 +1815,25 @@ func_parse_options ()
                       shift
                       ;;
 
-        --)           break ;;
+        --)           _G_rc_parse_options=: ; break ;;
         -*)           func_fatal_help "unrecognised option: '$_G_opt'" ;;
-        *)            set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
+        *)            set dummy "$_G_opt" ${1+"$@"}; shift
+                      _G_match_parse_options=false
+                      break
+                      ;;
       esac
+
+      $_G_match_parse_options && _G_rc_parse_options=:
     done
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    func_parse_options_result=$func_quote_for_eval_result
+
+    if $_G_rc_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      func_parse_options_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_parse_options
 }
 
 
@@ -1778,16 +1846,21 @@ func_validate_options ()
 {
     $debug_cmd
 
+    _G_rc_validate_options=false
+
     # Display all warnings if -W was not given.
     test -n "$opt_warning_types" || opt_warning_types=" $warning_categories"
 
-    func_run_hooks func_validate_options ${1+"$@"}
+    if func_run_hooks func_validate_options ${1+"$@"}; then
+      # save modified positional parameters for caller
+      func_validate_options_result=$func_run_hooks_result
+      _G_rc_validate_options=:
+    fi
 
     # Bail if the options were screwed!
     $exit_cmd $EXIT_FAILURE
 
-    # save modified positional parameters for caller
-    func_validate_options_result=$func_run_hooks_result
+    $_G_rc_validate_options
 }
 
 
@@ -2068,12 +2141,12 @@ include the following information:
        compiler:       $LTCC
        compiler flags: $LTCFLAGS
        linker:         $LD (gnu? $with_gnu_ld)
-       version:        $progname (GNU libtool) 2.4.6
+       version:        $progname $scriptversion Debian-2.4.6-9
        automake:       `($AUTOMAKE --version) 2>/dev/null |$SED 1q`
        autoconf:       `($AUTOCONF --version) 2>/dev/null |$SED 1q`
 
 Report bugs to <bug-libtool@gnu.org>.
-GNU libtool home page: <http://www.gnu.org/software/libtool/>.
+GNU libtool home page: <http://www.gnu.org/s/libtool/>.
 General help using GNU software: <http://www.gnu.org/gethelp/>."
     exit 0
 }
@@ -2270,6 +2343,8 @@ libtool_options_prep ()
     nonopt=
     preserve_args=
 
+    _G_rc_lt_options_prep=:
+
     # Shorthand for --mode=foo, only valid as the first argument
     case $1 in
     clean|clea|cle|cl)
@@ -2293,11 +2368,18 @@ libtool_options_prep ()
     uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u)
       shift; set dummy --mode uninstall ${1+"$@"}; shift
       ;;
+    *)
+      _G_rc_lt_options_prep=false
+      ;;
     esac
 
-    # Pass back the list of options.
-    func_quote_for_eval ${1+"$@"}
-    libtool_options_prep_result=$func_quote_for_eval_result
+    if $_G_rc_lt_options_prep; then
+      # Pass back the list of options.
+      func_quote_for_eval ${1+"$@"}
+      libtool_options_prep_result=$func_quote_for_eval_result
+    fi
+
+    $_G_rc_lt_options_prep
 }
 func_add_hook func_options_prep libtool_options_prep
 
@@ -2309,9 +2391,12 @@ libtool_parse_options ()
 {
     $debug_cmd
 
+    _G_rc_lt_parse_options=false
+
     # Perform our own loop to consume as many options as possible in
     # each iteration.
     while test $# -gt 0; do
+      _G_match_lt_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -2386,15 +2471,22 @@ libtool_parse_options ()
                         func_append preserve_args " $_G_opt"
                         ;;
 
-	# An option not handled by this hook function:
-        *)		set dummy "$_G_opt" ${1+"$@"};	shift; break  ;;
+        # An option not handled by this hook function:
+        *)              set dummy "$_G_opt" ${1+"$@"} ; shift
+                        _G_match_lt_parse_options=false
+                        break
+                        ;;
       esac
+      $_G_match_lt_parse_options && _G_rc_lt_parse_options=:
     done
 
+    if $_G_rc_lt_parse_options; then
+      # save modified positional parameters for caller
+      func_quote_for_eval ${1+"$@"}
+      libtool_parse_options_result=$func_quote_for_eval_result
+    fi
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    libtool_parse_options_result=$func_quote_for_eval_result
+    $_G_rc_lt_parse_options
 }
 func_add_hook func_parse_options libtool_parse_options
 
@@ -7272,10 +7364,14 @@ func_mode_link ()
       # -tp=*                Portland pgcc target processor selection
       # --sysroot=*          for sysroot support
       # -O*, -g*, -flto*, -fwhopr*, -fuse-linker-plugin GCC link-time optimization
+      # -specs=*             GCC specs files
       # -stdlib=*            select c++ std lib with clang
+      # -fsanitize=*         Clang/GCC memory and address sanitizer
+      # -fuse-ld=*           Linker select flags for GCC
       -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
       -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
-      -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*)
+      -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
+      -specs=*|-fsanitize=*|-fuse-ld=*)
         func_quote_for_eval "$arg"
 	arg=$func_quote_for_eval_result
         func_append compile_command " $arg"
@@ -7568,7 +7664,10 @@ func_mode_link ()
 	case $pass in
 	dlopen) libs=$dlfiles ;;
 	dlpreopen) libs=$dlprefiles ;;
-	link) libs="$deplibs %DEPLIBS% $dependency_libs" ;;
+	link)
+	  libs="$deplibs %DEPLIBS%"
+	  test "X$link_all_deplibs" != Xno && libs="$libs $dependency_libs"
+	  ;;
 	esac
       fi
       if test lib,dlpreopen = "$linkmode,$pass"; then
@@ -7887,19 +7986,19 @@ func_mode_link ()
 	    # It is a libtool convenience library, so add in its objects.
 	    func_append convenience " $ladir/$objdir/$old_library"
 	    func_append old_convenience " $ladir/$objdir/$old_library"
+	    tmp_libs=
+	    for deplib in $dependency_libs; do
+	      deplibs="$deplib $deplibs"
+	      if $opt_preserve_dup_deps; then
+		case "$tmp_libs " in
+		*" $deplib "*) func_append specialdeplibs " $deplib" ;;
+		esac
+	      fi
+	      func_append tmp_libs " $deplib"
+	    done
 	  elif test prog != "$linkmode" && test lib != "$linkmode"; then
 	    func_fatal_error "'$lib' is not a convenience library"
 	  fi
-	  tmp_libs=
-	  for deplib in $dependency_libs; do
-	    deplibs="$deplib $deplibs"
-	    if $opt_preserve_dup_deps; then
-	      case "$tmp_libs " in
-	      *" $deplib "*) func_append specialdeplibs " $deplib" ;;
-	      esac
-	    fi
-	    func_append tmp_libs " $deplib"
-	  done
 	  continue
 	fi # $pass = conv
 
@@ -8823,6 +8922,9 @@ func_mode_link ()
 	    revision=$number_minor
 	    lt_irix_increment=no
 	    ;;
+	  *)
+	    func_fatal_configuration "$modename: unknown library version type '$version_type'"
+	    ;;
 	  esac
 	  ;;
 	no)