GrapheneOS latest release includes a preliminary defense to prevent app-based VPN implementations from leaking DNS requests on Android when the VPN is down/connecting ( grapheneos.org )
Mullvad VPN's blog post: DNS traffic can leak outside the VPN tunnel on Android...