fix(net): Dns rejects the unspecified addresses (#2043, SR-AUD-304 wildcard half)

Dns::GetHostAddresses("0.0.0.0") returned the wildcard address.

This ticket was split out of #2039 precisely because it is the one half of the
finding that REMOVES A WORKING, MEANINGFUL RESULT, so it needed evidence rather
than judgement. The reference supplies it at three separate sites: Dns.cs:686-690
on the string path, and :46-50 / :158-162 on the IPAddress overloads, all
raising ArgumentException(SR.net_invalid_ip_addr) for IPAddress.Any or
IPAddress.IPv6Any.

.NET's message says why, and is transcribed rather than paraphrased: these are
unspecified addresses. They name every local interface to bind, and nothing at
all to connect -- so resolving one to itself hands a caller a target it cannot
use.

The rejection runs BEFORE the address-family check, matching the reference's own
ordering. GetHostAddresses("0.0.0.0", InterNetworkV6) is therefore an
ArgumentException, not a SocketException about the family, and a mutation that
moves the check after the family test is caught.

Only the two unspecified addresses moved. 127.0.0.1, ::1 and 8.8.8.8 still
resolve, and so does 0.0.0.1 -- the last of these asserting that the check is an
equality rather than a "starts with zero" test, which is the obvious way to get
this wrong.

+1 net test. Three mutations, all caught. Gate: 17,270 run, 0 failed, 38
executables -- green. Downstream, measured: zero Dns sites in either consumer.

SR-AUD-304 -> remediated, both halves. Record:
docs/Migration-DnsWildcardRejection.md.

Author: robertvokac

CLAUDE.md

@@ -0,0 +1,52 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# Migration — `Dns::GetHostAddresses` rejects the unspecified addresses (ticket #2043)
+
+*2026-08-17.* `Dns::GetHostAddresses("0.0.0.0")` returned the wildcard address. .NET raises
+`ArgumentException`.
+
+Landed under `docs/StandingApprovals.md` SA-5. No public signature, layout, vtable or `noexcept`
+change. **This removes a result that previously worked** — read §2.
+
+---
+
+## 1. What changed
+
+| Call | Was | Is |
+|---|---|---|
+| `GetHostAddresses("0.0.0.0")` | `{0.0.0.0}` | `ArgumentException` |
+| `GetHostAddresses("::")` | `{::}` | `ArgumentException` |
+| the same with an explicit `AddressFamily` | resolved | `ArgumentException` |
+| `GetHostAddresses("127.0.0.1")`, `"::1"`, `"8.8.8.8"`, `"0.0.0.1"` | — | **unchanged** |
+
+The rejection comes **before** the address-family check, matching `Dns.cs:686-690`, which tests
+the wildcard immediately after `TryParse` and before anything else looks at the value. So
+`GetHostAddresses("0.0.0.0", InterNetworkV6)` is an `ArgumentException`, not a `SocketException`
+about the family — and a test asserts that ordering.
+
+## 2. Why a working result is being removed
+
+This ticket was split out of #2039 precisely because it is the one half of SR-AUD-304 that takes
+away something that worked, so it needed evidence rather than judgement. The reference supplies
+it in three places — `Dns.cs:686-690` on the string path, and `:46-50` and `:158-162` on the
+`IPAddress` overloads — all raising `ArgumentException(SR.net_invalid_ip_addr)`.
+
+.NET's message says why, and the port transcribes rather than paraphrases it:
+
+> IPv4 address 0.0.0.0 and IPv6 address ::0 are unspecified addresses that cannot be used as a
+> target address.
+
+They name *every local interface* to `bind`, and *nothing at all* to `connect`. Resolving one to
+itself hands the caller a target it cannot use.
+
+## 3. To migrate
+
+If you passed `0.0.0.0` or `::` to `GetHostAddresses`, you were about to connect to an address
+that cannot be connected to. Use `IPAddress::Any` / `IPAddress::IPv6Any` directly for a `bind`,
+where they mean what you want, and do not route them through name resolution.
+
+## 4. Downstream, measured
+
+Neither `cna` nor `mobile-eggbert` references `System::Net::Dns` — **zero sites in both**.
+Neither repository was modified.

audit/AUDIT_FINDINGS_INDEX.md

@@ -2,6 +2,7 @@
 // Copyright (c) Robert Vokac and contributors
 // Portions based on .NET runtime API (MIT License, Copyright .NET Foundation and Contributors)
 #include "System/Net/Dns.hpp"
+#include "System/ArgumentException.hpp"
 #include "System/Net/Sockets/SocketException.hpp"
 #include <array>
 #include <cstring>
@@ -189,6 +190,32 @@ namespace System::Net {
         // and found nothing'". docs/SystemNetNamespaceReviewPlan.md §7.3 predicted an empty
         // result for the AddressFamily::Unix row; that prediction was made without those tests
         // in view and is corrected in §17.6 rather than followed.
+        /**
+         * @brief Rejects the two unspecified ("wildcard") addresses, as .NET does.
+         *
+         * Ticket #2043 (SR-AUD-304's wildcard half). `GetHostAddresses("0.0.0.0")` returned the
+         * wildcard address, and the ticket was split out of #2039 precisely because this is the
+         * one half that **removes a working, meaningful result** -- so it needed evidence rather
+         * than judgement. The reference supplies it: `Dns.cs:686-690` in the string path and
+         * `:46-50`, `:158-162` in the `IPAddress` overloads all raise
+         * `ArgumentException(SR.net_invalid_ip_addr)` for `IPAddress.Any` or `IPAddress.IPv6Any`.
+         *
+         * .NET's message says why, and it is transcribed rather than paraphrased: these are
+         * *unspecified* addresses. They name "every local interface" to `bind`, and nothing at
+         * all to `connect` -- so resolving one to itself hands a caller a target it cannot use.
+         *
+         * @param parameterName `"hostName"` on the string path and `"address"` on the
+         *        `IPAddress` one, matching .NET's own `nameof` at each site.
+         */
+        void throwIfUnspecifiedAddress(const IPAddress& address, const char* parameterName) {
+            if (address == IPAddress::Any || address == IPAddress::IPv6Any) {
+                throw System::ArgumentException(
+                    "IPv4 address 0.0.0.0 and IPv6 address ::0 are unspecified addresses that "
+                    "cannot be used as a target address.",
+                    parameterName);
+            }
+        }
+
         [[noreturn]] void throwNoAddressOfRequestedFamily(const std::string& host, AddressFamily family) {
             throw SocketException(SocketError::HostNotFound,
                                   "Dns: host '" + host + "' has no address in the requested address family '" +
@@ -224,6 +251,9 @@ namespace System::Net {
         throw System::PlatformNotSupportedException("Dns.GetHostAddresses is not supported on Emscripten.");
 #else
         if (auto literal = tryParseIPLiteral(hostNameOrAddress)) {
+            // #2043: BEFORE the family check, matching Dns.cs:686-690, which tests the wildcard
+            // immediately after IPAddress.TryParse and before anything else looks at the value.
+            throwIfUnspecifiedAddress(*literal, "hostNameOrAddress");
             if (!literalSatisfiesFamily(family, *literal)) {
                 throwNoAddressOfRequestedFamily(hostNameOrAddress, family);
             }

docs/Migration-DnsWildcardRejection.md

@@ -27,6 +27,7 @@
 // These tests use only IP literals and names this container resolves from /etc/hosts, so none
 // of them needs a network. The one place a real DNS answer would be required is guarded.
 #include <gtest/gtest.h>
+#include "System/ArgumentException.hpp"
 #include <algorithm>
 #include <string>
 #include <vector>
@@ -265,21 +266,57 @@ TEST(DnsErrorMessageTests, GetHostEntryFailureDoesNotNameAWin32Error) {
 }
 
 // ---------------------------------------------------------------------------
-// The wildcard is DELIBERATELY unchanged -- it is the gated ticket #2043's half
-// of SR-AUD-304, and this pin exists so that ticket cannot land silently.
+// #2043 RESOLVED -- the wildcard literals are rejected.
+//
+// The ticket was split out of #2039 precisely because this is the one half of SR-AUD-304 that
+// REMOVES A WORKING, MEANINGFUL RESULT, so it needed evidence rather than judgement. The
+// reference supplies it: Dns.cs:686-690 on the string path, and :46-50 / :158-162 on the
+// IPAddress overloads, all raise ArgumentException(SR.net_invalid_ip_addr) for IPAddress.Any or
+// IPAddress.IPv6Any.
 // ---------------------------------------------------------------------------
 
-TEST(DnsWildcardPinTests, WildcardLiteralsStillResolveToThemselves_SeeTicket2043) {
-    const std::vector<IPAddress> v4 = Dns::GetHostAddresses("0.0.0.0");
-    ASSERT_EQ(v4.size(), 1u);
-    EXPECT_EQ(v4[0], IPAddress::Any);
+TEST(DnsWildcardPinTests, Fix2043_WildcardLiteralsAreRejected) {
+    // .NET's message says WHY, and it is transcribed rather than paraphrased: these are
+    // UNSPECIFIED addresses. They name "every local interface" to bind, and nothing at all to
+    // connect -- so resolving one to itself hands a caller a target it cannot use.
+    for (const char* wildcard : {"0.0.0.0", "::"}) {
+        SCOPED_TRACE(wildcard);
+        EXPECT_THROW((void)Dns::GetHostAddresses(wildcard), System::ArgumentException);
+        EXPECT_THROW((void)Dns::GetHostAddresses(wildcard, AddressFamily::InterNetwork),
+                     System::ArgumentException);
+        EXPECT_THROW((void)Dns::GetHostAddresses(wildcard, AddressFamily::InterNetworkV6),
+                     System::ArgumentException);
+    }
+
+    // The rejection comes BEFORE the family check, matching Dns.cs:686-690, which tests the
+    // wildcard immediately after TryParse and before anything else looks at the value. So
+    // "0.0.0.0" with an IPv6-only request is an ArgumentException, not a SocketException about
+    // the family.
+    try {
+        (void)Dns::GetHostAddresses("0.0.0.0", AddressFamily::InterNetworkV6);
+        ADD_FAILURE() << "expected an ArgumentException";
+    } catch (const System::ArgumentException&) {
+        SUCCEED();
+    } catch (const SocketException&) {
+        ADD_FAILURE() << "the family check ran first; the wildcard check must come before it";
+    }
+}
+
+TEST(DnsWildcardPinTests, Fix2043_EveryOtherLiteralStillResolvesToItself) {
+    // The invariance row: only the two unspecified addresses moved. A loopback literal is not
+    // one of them, and neither is any ordinary address.
+    const std::vector<IPAddress> loopback = Dns::GetHostAddresses("127.0.0.1");
+    ASSERT_EQ(loopback.size(), 1u);
+    EXPECT_EQ(loopback[0], IPAddress::Loopback);
+
+    const std::vector<IPAddress> v6Loopback = Dns::GetHostAddresses("::1");
+    ASSERT_EQ(v6Loopback.size(), 1u);
+    EXPECT_EQ(v6Loopback[0], IPAddress::IPv6Loopback);
 
-    const std::vector<IPAddress> v6 = Dns::GetHostAddresses("::");
-    ASSERT_EQ(v6.size(), 1u);
-    EXPECT_EQ(v6[0], IPAddress::IPv6Any);
+    const std::vector<IPAddress> ordinary = Dns::GetHostAddresses("8.8.8.8");
+    ASSERT_EQ(ordinary.size(), 1u);
 
-    const std::vector<IPAddress> v4Family =
-        Dns::GetHostAddresses("0.0.0.0", AddressFamily::InterNetwork);
-    ASSERT_EQ(v4Family.size(), 1u);
-    EXPECT_EQ(v4Family[0], IPAddress::Any);
+    // ...and 0.0.0.1 is NOT the wildcard, so the check must be an equality rather than a
+    // "starts with zero" test.
+    EXPECT_NO_THROW((void)Dns::GetHostAddresses("0.0.0.1"));
 }