**Details**

When `_nss_dns_getnetbyaddr_r` receives `net==0`:
1. The loop `for (cnt = 4; net2 != 0; ...)` never executes (net2=0 fails condition)
2. `cnt` remains 4
3. The switch statement has cases 0-3 but **no case 4 or default**
4. `qbuf[1025]` is never initialized
5. Uninitialized stack bytes are sent to the DNS server as the query name

Vulnerable code in `resolv/nss_dns/dns-network.c`:

```c
  net2 = (uint32_t) net;
  for (cnt = 4; net2 != 0; net2 >>= 8)
    net_bytes[--cnt] = net2 & 0xff;

  switch (cnt)
    {
    case 3:  sprintf (qbuf, "0.0.0.%u.in-addr.arpa", ...); break;
    case 2:  sprintf (qbuf, "0.0.%u.%u.in-addr.arpa", ...); break;
    case 1:  sprintf (qbuf, "0.%u.%u.%u.in-addr.arpa", ...); break;
    case 0:  sprintf (qbuf, "%u.%u.%u.%u.in-addr.arpa", ...); break;
    // NO case 4! qbuf remains uninitialized
    }

  anslen = __res_context_query (ctx, qbuf, ...);  // Leaks stack to DNS
```

**Reproduction**
```c
#include <netdb.h>
int main() {
    getnetbyaddr(0, AF_INET); 
    return 0;
}
```
Reported-by: Igor Morgenstern, Aisle Research