Today, I found a way to replicate the issue via a normal command line, for example Ubuntu 19.10:
dig @fritz.box +short +tcp +keepopen example.com A example.net A
This creates two DNS transactions in one TCP connection. And yes, the current FRITZ!OS 07.12 fails to handle this. That confirms my theory and allows me to report it. However, while creating the issue report with AVM, I am not sure this is a bug but a feature: RFC 7766 from the year 2016 states that connection reuse via TCP is just a SHOULD. Consequently, this would be not a bug but a feature.
Actually kresd is the one who fails because it does not re-send the second query after the TCP connection got closed. I am going to file a feature request with AVM. However, where do I report that fail-over issue with kresd?
Finally in my setup, I am still not sure why kresd moves over to TCP at all. I am still not sure how to debug that. Am I able to compile kresd on a desktop computer and debug it via gdb for example? In other words, when I go for the KNOT resolver compile steps for Ubuntu, for example, do I get a very similar behavior as kresd on my Turris MOX? Or would anyone recommend another approach? I have to figure out why kresd is not doing UDP. And in the next step, I have to figure out who calls kresd as I see a full resolver usage at the very start of my Turris MOX although I disabled this via Foris.