The buffer-resizing code in addgetnetgrentX assumes that all string pointers point into the supplied buffer:

                            const char *nhost = data.val.triple.host;
                            const char *nuser = data.val.triple.user;
                            const char *ndomain = data.val.triple.domain;

                            size_t hostlen = strlen (nhost ?: "") + 1;
                            size_t userlen = strlen (nuser ?: "") + 1;
                            size_t domainlen = strlen (ndomain ?: "") + 1;

                            if (nhost == NULL || nuser == NULL || ndomain == NULL
                                || nhost > nuser || nuser > ndomain)
                              {
                                const char *last = nhost;
                                if (last == NULL
                                    || (nuser != NULL && nuser > last))
                                  last = nuser;
                                if (last == NULL
                                    || (ndomain != NULL && ndomain > last))
                                  last = ndomain;

                                size_t bufused
                                  = (last == NULL
                                     ? buffilled
                                     : last + strlen (last) + 1 - buffer);

                                /* We have to make temporary copies.  */
                                size_t needed = hostlen + userlen + domainlen;

                                if (buflen - req->key_len - bufused < needed)
                                  {
                                    buflen += MAX (buflen, 2 * needed);
                                    /* Save offset in the old buffer.  We don't
                                       bother with the NULL check here since
                                       we'll do that later anyway.  */
                                    size_t nhostdiff = nhost - buffer;
                                    size_t nuserdiff = nuser - buffer;
                                    size_t ndomaindiff = ndomain - buffer;

                                    char *newbuf = xrealloc (buffer, buflen);
                                    /* Fix up the triplet pointers into the new
                                       buffer.  */
                                    nhost = (nhost ? newbuf + nhostdiff
                                             : NULL);
                                    nuser = (nuser ? newbuf + nuserdiff
                                             : NULL);
                                    ndomain = (ndomain ? newbuf + ndomaindiff
                                               : NULL);
                                    *tofreep = buffer = newbuf;
                                  }

I do not think this is implied by the NSS API contract. We should simplify this code to use two buffers that are resized separately.