September 2026 patch took out our Windows Server 2019 DC, brought down DNS causing massive company-wide outage

2 DCs, Server 2019, both also running DNS. Domain Functional Level @ 2016.

After applying the September 2026 OOB patch (KB5129238) on the PDC, we got a ton of NETLOGON event 5775s:

The dynamic deletion of the DNS record '_kerberos._ tcp.contoso.sites.contoso.com 600 IN SRV 0 100 88 PDC.contoso.com' failed on the following DNS server: DNS server IP address: <PDC IP> Returned Response Code (RCODE): 5 Returned Status Code: 9017 

DNS stopped working across the entire domain. Was also unable to even launch dnsmgmt.msc on the DC, got an "Access Denied" error, even though the DNS Server service was running. Restarting the server/services didn't fix it. Shutting down the PDC has alleviated the issue for now. We've rolled back the patch and looking to bring the PDC back online tonight, but thought I'd ask in here to see if anyone else has come across this issue?

AI seems to think that the DC lost its machine-account/secure-channel relationship, but my understanding was that issue only affected servers with Machine Identity Isolation enabled (which we don't), so I'm not sure that is the case here.

Just posting this out here in case anyone else has seen this in their environment.