if "rndc reload" fails, the result code is supposed to be passed to zone_postload, but for inline-signing zones, the result can be overwritten first by a call to the ZONE_TRYLOCK macro. this can lead to the partially-loaded unsigned zone being synced over to the signed zone instead of being rejected.