A safe way to detect NDR is checking the message headers also in the scan phase in bavd.
For example, Exim4 will add a special header to all NDRs.
If this feature is added to bavd, the following header is a 100% safe match for Exim4:
^X-Failed-Recipients:.*
References (click text for links):
- Forum post, missing bav.rule for Exim4
- SourceForge request to add the above
- Exim specification
(§3.5 "Delivery failure messages contain an X-Failed-Recipients: header, listing all failed addresses, for the benefit of programs that try to analyse such messages automatically.")