the latest dnscap is duane's fork (https://github.com/verisign/dnscap) and i suggest repeating your tests with that version rather than the old oarc version. it strikes me that you've found evidence of a bug and that we should find and fix that bug.)