dynamic update that replaces all apex NS records leaves a mix of old and new records
If you send a dynamic update which replaces all the NS records at the apex (removes old + adds new), this currently results in something like this (as detailed in the log):
deleting an RR at example.com NS
attempt to delete last NS ignored
adding an RR at 'example.com' NS ns1.example.com.
adding an RR at 'example.com' NS ns2.example.com.
Ie, because this "attempt to delete last NS ignored" check, seemingly meant to guard against leaving a zone in an invalid state, triggers without taking the entire transaction into account, BIND skips part of the update and leaves a mix of old and new records for no good reason (the end result would have been perfectly valid).
Additionally, I think really if such a validation step fails, I really believe that the reasonable behavior would be that no change is applied at all, and that an error rcode would be returned, rather than silently making part of the requested change.