CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2connwritevstream()' returns 'NGTCP2ERRSTREAMDATABLOCKED', Unbound continues to call 'ngtcp2ccerrsetapplicationerror()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64t errorcode' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2connwriteconnectionclose()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2putuvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initialmaxstreamdatabidilocal = 1' in its transport parameters and sending one DoQ query without ever reading the stream.