dtaht:

• Device problem occurs on: archer c7v2 talking to a linux or osx box, bind9 host tool
• Software versions of LEDE release, packages, etc: lede head with dnsmasq-full (and dnssec enabled)
• Steps to reproduce:

root@dancer:/# host flent-fremont.bufferbloat.net
flent-fremont.bufferbloat.net has address 23.239.20.41
flent-fremont.bufferbloat.net has IPv6 address 2600:3c01::f03c:91ff:fe50:48d4
;; Got bad packet: bad compression pointer
111 bytes
40 41 81 80 00 01 00 00 00 01 00 00 0d 66 6c 65 @A...........fle
6e 74 2d 66 72 65 6d 6f 6e 74 0b 62 75 66 66 65 nt-fremont.buffe
72 62 6c 6f 61 74 03 6e 65 74 00 00 0f 00 01 c0 rbloat.net......
1a 00 06 00 01 00 00 0e 10 00 34 06 61 72 6e 6f ..........4.arno
6c 64 02 6e 73 0a 63 6c 6f 75 64 66 6c 61 72 65 ld.ns.cloudflare
03 63 6f 6d 00 03 64 6e 73 c0 f0 78 9d d7 47 00 .com..dns..x..G.
00 27 10 00 00 09 60 00 09 3a 80 00 00 0e 10 .'....`..:.....

I will back off dnssec and try harder, but I've seen this periodically for months now on osx. I'll try a few other boxes. I don't get this when testing dnssec compliance from the browser.