diff --git a/CHANGES b/CHANGES
index 710142889c..3da1a93a0d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+5222.	[bug]		'delve -t ANY' could leak memory. [GL #983]
+
 5221.	[test]		Enable parallel execution of system tests on
 			Windows. [GL !4101]
 
diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
index f5760fe7c0..aecc104a6f 100644
--- a/bin/tests/system/digdelv/tests.sh
+++ b/bin/tests/system/digdelv/tests.sh
@@ -55,7 +55,7 @@ check_ttl_range() {
 
 # using delv insecure mode as not testing dnssec here
 delv_with_opts() {
-    "$DELV" -i -p "$PORT" "$@"
+    "$DELV" +noroot +nodlv -p "$PORT" "$@"
 }
 
 KEYID="$(cat ns2/keyid)"
@@ -852,13 +852,23 @@ if [ -x "$DELV" ] ; then
   n=$((n+1))
   echo_i "check that delv -q -m works ($n)"
   ret=0
-  delv_with_opts @10.53.0.3 -q -m > delv.out.test$n 2>&1
+  delv_with_opts @10.53.0.3 -q -m > delv.out.test$n 2>&1 || ret=1
   grep '^; -m\..*[0-9]*.*IN.*ANY.*;' delv.out.test$n > /dev/null || ret=1
   grep "^add " delv.out.test$n > /dev/null && ret=1
   grep "^del " delv.out.test$n > /dev/null && ret=1
   check_ttl_range delv.out.test$n '\\-ANY' 300 3 || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that delv -t ANY works ($n)"
+  ret=0
+  delv_with_opts @10.53.0.3 -t ANY example > delv.out.test$n 2>&1 || ret=1
+  grep "^example." < delv.out.test$n > /dev/null || ret=1
+  check_ttl_range delv.out.test$n NS 300 || ret=1
+  check_ttl_range delv.out.test$n SOA 300 || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
 else
   echo_i "$DELV is needed, so skipping these delv tests"
 fi
diff --git a/lib/dns/client.c b/lib/dns/client.c
index 7e0bceb324..422a763617 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -123,10 +123,10 @@ typedef struct resctx {
 	unsigned int		magic;
 	isc_mutex_t		lock;
 	dns_client_t		*client;
-	bool		want_dnssec;
-	bool		want_validation;
-	bool		want_cdflag;
-	bool		want_tcp;
+	bool			want_dnssec;
+	bool			want_validation;
+	bool			want_cdflag;
+	bool			want_tcp;
 
 	/* Locked */
 	ISC_LINK(struct resctx)	link;
@@ -139,7 +139,7 @@ typedef struct resctx {
 	dns_namelist_t		namelist;
 	isc_result_t		result;
 	dns_clientresevent_t	*event;
-	bool		canceled;
+	bool			canceled;
 	dns_rdataset_t		*rdataset;
 	dns_rdataset_t		*sigrdataset;
 } resctx_t;
@@ -158,7 +158,7 @@ typedef struct resarg {
 	isc_result_t		vresult;
 	dns_namelist_t		*namelist;
 	dns_clientrestrans_t	*trans;
-	bool		canceled;
+	bool			canceled;
 } resarg_t;
 
 /*%
@@ -173,7 +173,7 @@ typedef struct reqctx {
 
 	/* Locked */
 	ISC_LINK(struct reqctx)	link;
-	bool		canceled;
+	bool			canceled;
 	dns_tsigkey_t		*tsigkey;
 	dns_request_t		*request;
 	dns_clientreqevent_t	*event;
@@ -191,7 +191,7 @@ typedef struct reqarg {
 	/* Locked */
 	isc_result_t		result;
 	dns_clientreqtrans_t	*trans;
-	bool		canceled;
+	bool			canceled;
 } reqarg_t;
 
 /*%
@@ -206,7 +206,7 @@ typedef struct updatearg {
 	/* Locked */
 	isc_result_t		result;
 	dns_clientupdatetrans_t	*trans;
-	bool		canceled;
+	bool			canceled;
 } updatearg_t;
 
 /*%
@@ -217,14 +217,14 @@ typedef struct updatectx {
 	unsigned int			magic;
 	isc_mutex_t			lock;
 	dns_client_t			*client;
-	bool			want_tcp;
+	bool				want_tcp;
 
 	/* Locked */
 	dns_request_t			*updatereq;
 	dns_request_t			*soareq;
 	dns_clientrestrans_t		*restrans;
 	dns_clientrestrans_t		*restrans2;
-	bool			canceled;
+	bool				canceled;
 
 	/* Task Locked */
 	ISC_LINK(struct updatectx) 	link;
@@ -1096,6 +1096,12 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 					}
 				}
 			}
+			if (rctx->rdataset != NULL) {
+				putrdataset(mctx, &rctx->rdataset);
+			}
+			if (rctx->sigrdataset != NULL) {
+				putrdataset(mctx, &rctx->sigrdataset);
+			}
 			if (n == 0) {
 				/*
 				 * We didn't match any rdatasets (which means