Comment 8 for bug 1413388

These is a second issue here - the upgrades also adds the include mentioned in James's attachment:

include "/etc/bind/maas/named.conf.options.inside.maas";

This file, in my case, contained three lines:

allow-query { any; };
allow-recursion { trusted; };
allow-query-cache { trusted; };

Since our original config already set values for both allow-query and allow-query-cache, bind9 refused to start post-upgrade until I either commented out the duplicate line in the include file, or in our own config.