As discussed in [Pdns-users] Question regarding DNSSEC RRSIG, a pdns 3.1 slave running mysql may in some situations return bogus NSECs.
I've pushed a branch containing a testcase for this issue to https://github.com/habbie/powerdns/tree/nsec-underscore
It also contains hacky fixes for gmysql and gpgsql. Especially the gpgsql fix is unsuitable as it requires dropping/restoring whole databases. The gmysql-fix is easier to apply to current setups but it needs a little more love.
(bindbackend and gsqlite3 do not have any trouble with the issue)
r2710 fixes this!