diff -urN bind-9.4.0/CHANGES bind-9.4.1/CHANGES
--- bind-9.4.0/CHANGES	Thu Feb 15 11:16:47 2007
+++ bind-9.4.1/CHANGES	Mon Apr 30 10:11:29 2007
@@ -1,4 +1,9 @@
 
+	--- 9.4.1 released ---
+
+2172.	[bug]		query_addsoa() was being called with a non zone db.
+			[RT #16834]
+
 	--- 9.4.0 released ---
 
 2138.	[bug]		Lock order reversal in resolver.c. [RT #16653]
diff -urN bind-9.4.0/README bind-9.4.1/README
--- bind-9.4.0/README	Wed Jun 14 14:03:23 2006
+++ bind-9.4.1/README	Mon Apr 30 10:11:30 2007
@@ -43,6 +43,11 @@
 		Nominum, Inc.
 
 
+BIND 9.4.1
+
+	BIND 9.4.1 is a security release, containing a fix for a
+	security bug in 9.4.0.
+	
 BIND 9.4.0
 
 	BIND 9.4.0 has a number of new features over 9.3,
diff -urN bind-9.4.0/bin/named/query.c bind-9.4.1/bin/named/query.c
--- bind-9.4.0/bin/named/query.c	Mon Jan  8 11:41:59 2007
+++ bind-9.4.1/bin/named/query.c	Mon Apr 30 10:10:19 2007
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.257.18.36 2007/01/08 02:41:59 marka Exp $ */
+/* $Id: query.c,v 1.257.18.36.12.1 2007/04/30 01:10:19 marka Exp $ */
 
 /*! \file */
 
@@ -4209,6 +4209,21 @@
 				 * an error unless we were searching for
 				 * glue.  Ugh.
 				 */
+				if (!is_zone) {
+					authoritative = ISC_FALSE;
+					dns_rdatasetiter_destroy(&rdsiter);
+					if (RECURSIONOK(client)) {
+						result = query_recurse(client,
+								       qtype,
+								       NULL,
+								       NULL);
+						if (result == ISC_R_SUCCESS)
+						    client->query.attributes |=
+							NS_QUERYATTR_RECURSING;
+						else
+						    QUERY_ERROR(DNS_R_SERVFAIL);					}
+					goto addauth;
+				}
 				/*
 				 * We were searching for SIG records in
 				 * a nonsecure zone.  Send a "no error,
diff -urN bind-9.4.0/version bind-9.4.1/version
--- bind-9.4.0/version	Thu Feb 15 10:42:38 2007
+++ bind-9.4.1/version	Mon Apr 30 10:11:30 2007
@@ -1,10 +1,10 @@
-# $Id: version,v 1.29.134.13 2007/02/15 01:42:38 each Exp $
+# $Id: version,v 1.29.134.13.8.1 2007/04/30 01:11:30 marka Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=4
-PATCHVER=0
+PATCHVER=1
 RELEASETYPE=
 RELEASEVER=