diff --git a/bind-9.5-pool_badfree.patch b/bind-9.5-pool_badfree.patch
new file mode 100644
index 0000000..7aa577a
--- /dev/null
+++ b/bind-9.5-pool_badfree.patch
@@ -0,0 +1,30 @@
+Written-by: Tomas Mraz <tmraz@redhat.com>
+Reviewed-by: Adam Tkac <atkac@redhat.com>
+
+diff -up bind-9.5.0a6/lib/dns/resolver.c.badfree bind-9.5.0a6/lib/dns/resolver.c
+--- bind-9.5.0a6/lib/dns/resolver.c.badfree	2007-06-19 01:47:41.000000000 +0200
++++ bind-9.5.0a6/lib/dns/resolver.c	2007-09-05 16:20:21.000000000 +0200
+@@ -7455,17 +7455,17 @@ dns_resolver_createdispatchpool(dns_reso
+ 	return (result);
+ 
+   cleanup:
+-	for (i = 0; i < ndisps; i++) {
+-		if (res->dispatchv4pool[i] != NULL)
+-			dns_dispatch_detach(&res->dispatchv4pool[i]);
+-		if (res->dispatchv6pool[i] != NULL)
+-			dns_dispatch_detach(&res->dispatchv6pool[i]);
+-	}
+ 	if (res->dispatchv4pool != NULL) {
++		for (i = 0; i < ndisps; i++)
++			if (res->dispatchv4pool[i] != NULL)
++				dns_dispatch_detach(&res->dispatchv4pool[i]);
+ 		isc_mem_put(res->mctx, res->dispatchv4pool,
+ 			    sizeof(dns_dispatch_t *) * ndisps);
+ 	}
+ 	if (res->dispatchv6pool != NULL) {
++		for (i = 0; i < ndisps; i++)
++			if (res->dispatchv6pool[i] != NULL)
++				dns_dispatch_detach(&res->dispatchv6pool[i]);
+ 		isc_mem_put(res->mctx, res->dispatchv6pool,
+ 			    sizeof(dns_dispatch_t *) * ndisps);
+ 	}
diff --git a/bind.spec b/bind.spec
index f028c21..e0de51c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -21,7 +21,7 @@ Summary: 	The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name: 		bind
 License: 	ISC
 Version: 	9.5.0
-Release: 	11.3.%{RELEASEVER}%{?dist}
+Release: 	11.9.%{RELEASEVER}%{?dist}
 Epoch:   	32
 Url: 		http://www.isc.org/products/BIND/
 Buildroot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -67,6 +67,7 @@ Patch72:	bind-9.5-dlz-64bit.patch
 Patch75:	bind-9.5-update.patch
 Patch76:	bind-9.5-2119_revert.patch
 Patch77:	bind-9.5-fix_h_errno.patch
+Patch78:	bind-9.5-pool_badfree.patch
 
 # SDB patches
 Patch11: 	bind-9.3.2b2-sdbsrc.patch
@@ -250,6 +251,7 @@ cp -fp contrib/dbus/{dbus_mgr.h,dbus_service.h} bin/named/include/named
 %patch75 -p1 -b .update
 %patch76 -p1 -b .2119
 %patch77 -p1 -b .errno
+%patch78 -p1 -b .badfree
 :;
 
 
@@ -404,7 +406,7 @@ for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.int
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
 done
-/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.213 2007/09/05 09:56:24 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\
+/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.214 2007/09/06 08:10:34 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\
  *\
  * NOTE: you only need to create this file if it is to\
  * differ from the following default contents:
@@ -646,6 +648,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/bind-chroot-admin
 
 %changelog
+* Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.9.a6
+- fixed wrong resolver's dispatch pool cleanup (#275011, patch from 
+  tmraz redhat com)
+
 * Wed Sep 05 2007 Adam Tkac <atkac redhat com> 32:9.5.0-11.3.a6
 - initscript failure message is now printed correctly (#277981,
   Quentin Armitage (quentin armitage org uk) )