Tristan reports:

DNS SOA Serial uint32-to-uint16 Truncation Bypasses Update Ordering
===================================================================
CVSS 3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CWE: CWE-681 (Incorrect Conversion between Numeric Types)
Auth: TSIG/GSS-API authenticated DNS client
Version: Samba 4.24.3 and prior, master (2026-06-25)

File: source4/dns_server/dns_update.c, line 510

Root Cause:

The DNS dynamic update handler declares SOA serial variables as uint16_t
instead of uint32_t (per RFC 1035 and Samba's own IDL definition). This
truncation causes the serial comparison to accept updates that should be
rejected. With date-based serials (e.g., 2024010100, common in AD), the
upper 16 bits are silently discarded.

    // dns_update.c:510
    uint16_t n, o;  // WRONG: SOA serial is uint32 per IDL and RFC 1035

    // IDL definition (correct):
    typedef struct { ... uint32 serial; ... } dns_soa_record;

    // Line 518: comparison uses truncated values
    if (n <= o) {
        // reject update - serial not advancing
    }

Data Flow:

  Zone SOA serial = 65537 (0x10001) -> truncated to 1
  -> attacker sends update with serial 2 -> truncated to 2
  -> comparison: 2 > 1 -> update accepted
  -> real comparison should be: 2 <= 65537 -> reject

Impact:

Authenticated DNS clients can bypass serial ordering to inject or
overwrite DNS records. In AD-integrated DNS, zone serials are commonly
above 65535, making this universally exploitable. Breaks the fundamental
SOA serial ordering guarantee.

Lab verified: code trace confirmed uint16_t declaration vs uint32 IDL.