The reason for the crash is that named is not allowed to read Kali's OpenSSL configuration at /etc/ssl/kali.cnf which is included by /etc/ssl/openssl.cnf, as the following strace output shows:

┌──(kali㉿kali)-[~]
└─$ sudo strace -e trace=file named --help
execve("/usr/sbin/named", ["named", "--help"], 0x7ffe20ca96c8 / 13 vars /) = 0
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
[... loading .so libraries ...]
readlink("/etc/malloc.conf", 0x7ffe3c544760, 4096) = -1 ENOENT (No such file or directory)
open("/proc/sys/vm/overcommit_memory", O_RDONLY|O_CLOEXEC) = 3
open("/sys/kernel/mm/transparent_hugepage/enabled", O_RDONLY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=12550, ...}, AT_EMPTY_PATH) = 0
newfstatat(AT_FDCWD, "/etc/ssl/kali.cnf", {st_mode=S_IFREG|0644, st_size=653, ...}, 0) = 0
openat(AT_FDCWD, "/etc/ssl/kali.cnf", O_RDONLY) = -1 EACCES (Permission denied)
tls.c:88: fatal error: RUNTIME_CHECK(OPENSSL_init_ssl((0x00000200L | 0x00000400L | 0x00001000L | 0x00002000L | 0x00004000L) | 0x00000040L, ((void *)0)) == 1) failed
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=2631, si_uid=0} ---
+++ killed by SIGABRT +++
zsh: IOT instruction sudo strace -e trace=file named --help

This is due to the file /etc/ssl/kali.cnf not being included in the Apparmor policy /etc/apparmor.d/usr.sbin.named which is shipped as part of the "bind9" package.

Adding a line like "/etc/ssl/kali.cnf r," to the Apparmor policy fixes the issue.

Thanks for the excellent bug report!

I opened an issue on the Debian bug tracker, to see if the bind9 maintainers would be willing to relax the apparmor profile for named: https://bugs.debian.org/1025519.

This is solved in package bind9 version 9.18.10-2, in Debian. The package didn't reach Kali yet.

The package bind9 9.18.10-2 is now in kali-rolling, so the issue is solved with:

<pre>
apt update && apt full-upgrade -y
</pre>

Closing.