dnsmasq loads every file in /etc/dnsmasq.d/ (skipping only .dpkg-*). SafeApply was leaving .bak backup files after successful applies, causing duplicate/conflicting DNS records. Also moves dnsmasq's validation temp file to /tmp so a crash can't leave a .validate file in the conf dir.