Need help debugging Kconfig recursive dependencies

So, I’m trying to update the bind package to support building with gssapi as a variant instead of it being a compile-time option.

A first stab at this is here, with the most important part being the Makefile. To illustrate the problem I’m facing, consider the definition of bind-tools:

define Package/bind-tools
  $(Package/bind/Default)
  TITLE+= administration tools (all)
  DEPENDS:= \
	+bind-check \
	+bind-delv \
	+bind-dig \
	+bind-nslookup \
	+bind-dnssec \
	+bind-host \
	+bind-rndc \
	+bind-ddns-confgen
endef

Now, each package (like bind-nslookup) comes in two flavours with my patches: bind-nslookup and bind-nslookup-gssapi. This is modelled after e.g. ethtool which has a Makefile like this:

define Package/ethtool
  SECTION:=net
  CATEGORY:=Network
  TITLE:=Display or change ethernet card settings
  URL:=http://www.kernel.org/pub/software/network/ethtool/
  VARIANT:=tiny
  CONFLICTS:=ethtool-full
endef

define Package/ethtool-full
  $(Package/ethtool)
  TITLE += (full)
  VARIANT:=full
  PROVIDES:=ethtool
  DEPENDS:=+libmnl
  CONFLICTS:=
endef

This allows packages to depend on ethtool and it’ll be satisfied by ethtool or ethtool-full

So, returning to e.g. bind-nslookup from my branch, the relevant part of the Makefile looks like this:

define Package/bind-nslookup
  $(Package/bind/Default)
  TITLE+= tools (nslookup)
  ALTERNATIVES:= \
	  200:/usr/bin/nslookup:/usr/libexec/nslookup-bind
  CONFLICTS:=bind-nslookup-gssapi
endef

define Package/bind-nslookup-gssapi
  $(Package/bind-gssapi/Default)
  TITLE+= tools (nslookup) with GSSAPI
  ALTERNATIVES:= \
	  200:/usr/bin/nslookup:/usr/libexec/nslookup-bind
  PROVIDES:=bind-nslookup
endef

And that works as expected, the relevant parts of tmp/.config-package.in ends up looking like this:

        config PACKAGE_bind-tools
                tristate "bind-tools............................... bind administration tools (all)"
                default y if DEFAULT_bind-tools
                default m if ALL
                depends on !(BIND_JEMALLOC) || ((mips||mipsel||mips64||powerpc64||x86_64||arm||aarch64||loongarch64)||(USE_GLIBC&&(powerpc||i386)))
                depends on !arc
                select PACKAGE_bind-check 
                select PACKAGE_bind-ddns-confgen if PACKAGE_bind-ddns-confgen-gssapi<PACKAGE_bind-tools 
                select PACKAGE_bind-delv if PACKAGE_bind-delv-gssapi<PACKAGE_bind-tools 
                select PACKAGE_bind-dig 
                select PACKAGE_bind-dnssec if PACKAGE_bind-dnssec-gssapi<PACKAGE_bind-tools 
                select PACKAGE_bind-host if PACKAGE_bind-host-gssapi<PACKAGE_bind-tools 
                select PACKAGE_bind-nslookup if PACKAGE_bind-nslookup-gssapi<PACKAGE_bind-tools 
                select PACKAGE_bind-rndc if PACKAGE_bind-rndc-gssapi<PACKAGE_bind-tools
                select PACKAGE_libc
                help
                 bind administration tools (all)

The reference to select PACKAGE_bind-nslookup if PACKAGE_bind-nslookup-gssapi<PACKAGE_bind-tools basically means to select bind-nslookup if bind-nslookup-gssapi hasn’t already been selected, which is what’s intended.

Now, if I try to do the same thing to bind-check by uncommenting the PROVIDES line in the Makefile:

define Package/bind-check
  $(Package/bind/Default)
  TITLE+= tools (named-checkconf, named-checkzone)
  CONFLICTS:=bind-check-gssapi
endef

define Package/bind-check-gssapi
  $(Package/bind-gssapi/Default)
  TITLE+= tools (named-checkconf, named-checkzone) with GSSAPI
  #PROVIDES:=bind-check
endef

make menuconfig goes gaga and starts complaining:

tmp/.config-package.in:98795:error: recursive dependency detected!
tmp/.config-package.in:98795:	symbol PACKAGE_bind-tools depends on PACKAGE_bind-tools
For a resolution refer to Documentation/kbuild/kconfig-language.rst
subsection "Kconfig recursive dependency limitations"

And the same section of tmp/.config-package.in suddenly turns into this:

        config PACKAGE_bind-tools
                tristate "bind-tools............................... bind administration tools (all)"
                default y if DEFAULT_bind-tools
                default m if ALL
                depends on !(BIND_JEMALLOC) || ((mips||mipsel||mips64||powerpc64||x86_64||arm||aarch64||loongarch64)||(USE_GLIBC&&(powerpc||i386)))
                depends on !(PACKAGE_bind-check-gssapi<PACKAGE_bind-tools && BIND_JEMALLOC) || ((mips||mipsel||mips64||powerpc64||x86_64||arm||aarch64||loongarch64)||(USE_GLIBC&&(powerpc||i386)))
                depends on !(PACKAGE_bind-check-gssapi<PACKAGE_bind-tools) || !arc
                depends on !(PACKAGE_bind-delv-gssapi<PACKAGE_bind-tools && BIND_JEMALLOC) || ((mips||mipsel||mips64||powerpc64||x86_64||arm||aarch64||loongarch64)||(USE_GLIBC&&(powerpc||i386)))
                depends on !(PACKAGE_bind-delv-gssapi<PACKAGE_bind-tools) || !arc
                depends on !arc
                select PACKAGE_bind-check if PACKAGE_bind-check-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-ddns-confgen if PACKAGE_bind-ddns-confgen-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-delv if PACKAGE_bind-delv-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-dig
                select PACKAGE_bind-dnssec if PACKAGE_bind-dnssec-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-host if PACKAGE_bind-host-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-nslookup if PACKAGE_bind-nslookup-gssapi<PACKAGE_bind-tools
                select PACKAGE_bind-rndc if PACKAGE_bind-rndc-gssapi<PACKAGE_bind-tools
                select PACKAGE_libc
                help
                 bind administration tools (all)

The depends on !(PACKAGE_bind-check-gssapi<PACKAGE_bind-tools… type of lines above are suddenly added (and seem bogus).

Any idea what I’m doing wrong and/or how I could further debug the whole dependency checking in make menuconfig?