NXDOMAIN is incorrectly synthesized from NSEC for records under a DNAME

With setup:

zone1: foo.zone1 IN DNAME zone2 foo.zone1 IN NSEC fzz.zone1. fzz.zone1 IN A 1.2.3.4 (...)

zone2: a IN A 1.2.3.4

if we force named to cache foo.zone1 (e.g. by dig ns foo.zone1) then all subsequent queries to names under foo.zone1 (e.g. dig a a.foo.zone1) will fail because named will incorrectly synthesize an NXDOMAIN from the NSEC record.