I have made sure that this fix does not allow DNS packets which would cause security problems to be forwarded to the DNS stub resolver (we still make sure the ID and question are the same).
I would like to thank Jakob Blomer at CERN laboratories for reporting this problem, and for supplying a patch.
It can be looked at here:
http://maradns.org/deadwood/snap/