Comment 7 for bug 1031217

The workaround almost works for me. The only thing is that no matter what I ask, I get the A record for the item as a reply.
For example, doing a 'dig zonetransfer.me ns' on Ubuntu 12.10 outside the virtual machine, I get the expected:

-------[snip]-------
; <<>> DiG 9.8.1-P1 <<>> zonetransfer.me ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42598
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;zonetransfer.me. IN NS

;; ANSWER SECTION:
zonetransfer.me. 5689 IN NS ns16.zoneedit.com.
zonetransfer.me. 5689 IN NS ns12.zoneedit.com.

;; ADDITIONAL SECTION:
ns16.zoneedit.com. 5689 IN A 69.64.68.41
ns12.zoneedit.com. 5635 IN A 209.62.64.46

;; Query time: 2 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Fri Oct 19 14:38:40 2012
;; MSG SIZE rcvd: 115
-------[/snip]--------

Inside a virtual machine with natdnshostresolver1 on, the same command yields the utterly unexpected:
-------[snip]-------
; <<>> DiG 9.7.0-P1 <<>> zonetransfer.me ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58758
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;zonetransfer.me. IN NS

;; ANSWER SECTION:
zonetransfer.me. 3600 IN A 217.147.180.162

;; Query time: 3 msec
;; SERVER: 10.0.2.3#53(10.0.2.3)
;; WHEN: Fri Oct 19 14:38:54 2012
;; MSG SIZE rcvd: 49
-------[/snip]-------

A tcpdump on the Ubuntu host says:
-------[snip]-------
14:50:24.700197 IP 127.0.0.1.33430 > 127.0.1.1.53: 53611+ A? zonetransfer.me. (33)
14:50:24.701638 IP 127.0.1.1.53 > 127.0.0.1.33430: 53611 1/2/2 A 217.147.180.162 (131)
-------[/snip]-------

So this seems to be a problem with the NAT engine asking the wrong question.

Does anybody have a workaround for this one?