I've had a report from someone with clue (and tcpdump) that a properly functioning DNS resolver that correctly uses randomised source ports
magically becomes vulnerable once the traffic's passed through a
Checkpoint firewall.

This is a very interesting observation that isn't constrained to Checkpoint... any NAT device that your DNS requests go through might steal any entropy your machine employed in selecting your source UDP port. There is no simple solution. The hacks on top of hacks on top of hacks here might just be near the collapsing point.