What were you trying to do that didn't work?

Make a DNSSEC request.

What is the impact of this issue to you?

Significant time wasted figuring out why DNSSEC would not validate.

Please provide the package NVR for which the bug is seen:

unbound-1.16.2-3.el9_3.5.x86_64

How reproducible is this bug?:

Always

Steps to reproduce

1. Install unbound with default configuration.
2. Attempt a DNSSEC validation against a domain with a SHA1 signature.

Expected results

A clear, unambiguous error message saying that validation failed due to an unsupported algorithm, SERVFAIL response, EDE response.

Actual results

Successful return of DNS request, with the tiny detail that the ad flag is missing.

No error messages, no warnings, no EDE response, no indication what was wrong.