test(net): two Dns tests asserted the resolver's opinion, not the port's (#2375)

The full gate surfaced two failures in `SharpRuntimeTests_Net` that the production
code did not cause, and both are the same defect: the test asserted something the
resolver decides.

  1. `MalformedLiteralTextIsStillRejected` required six strings to fail to resolve.
     On this container "1.2.3." takes a 13 ms DNS round trip and comes back as
     1.2.0.3 -- where "1.2.3" is answered by libc's digits-and-dots shortcut in
     0.03 ms, so the trailing dot is what sends it to the network. Any wildcard DNS
     server can make that test fail, and .NET's Dns.GetHostAddresses would return
     the same address here because it calls the same getaddrinfo.

  2. `GetHostEntry_ByAddress_WithNoReverseMapping_TerminatesInsteadOfRecursing`
     required the call to RETURN an entry. One gate run raised
     "Temporary failure in name resolution" (EAI_AGAIN) for 192.0.2.1 while five
     isolated runs passed.

Neither is a regression: both reproduce with the in-flight change stashed, and
neither test can be reached from `modules/core`. Neither is disabled, weakened,
skipped or recategorised.

The repairs keep the findings and drop the environment.

  1. Two assertions replace one. `IPAddress::TryParse` must reject the text -- that
     is the whole of SR-AUD-304, which was that `Dns` had a SECOND, disagreeing IPv4
     parser, and it holds on every machine. Then the test calls `getaddrinfo` itself
     and requires `Dns::GetHostAddresses` to AGREE with that independent oracle:
     throw when the resolver has no answer, and otherwise return exactly the
     resolver's address set. This is the oracle pattern #2351 established for
     tzdata. It is strictly stronger than what it replaces -- the old test could not
     express that a SUCCESSFUL resolution is reported faithfully, with no fabricated
     entries and no duplicates.

  2. The finding there is about TERMINATION. An unbounded mutual recursion overflows
     the stack and takes the process down, so it can neither return nor throw; a
     resolver that answers, one that says "no such name", and one that is briefly
     unreachable are all acceptable. The test now asserts that, plus the structural
     invariants when an entry does come back.

The file header's claim that "none of them needs a network" was measured false for
exactly one row and is corrected in place rather than left standing.

Mutations, both caught: returning an empty vector instead of raising on resolution
failure; giving malformed text a literal reading by trimming a trailing space or dot.

The test count does not move -- two tests rewritten, none added.

docs/DnsLiteralOracleTestDefect.md

Author: robertvokac

docs/DnsLiteralOracleTestDefect.md

@@ -0,0 +1,78 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# A `Dns` test asserted the resolver's opinion, not the port's (ticket #2375)
+
+*2026-08-18.* `DnsLiteralTests.MalformedLiteralTextIsStillRejected` failed on this container
+while the production code was correct. The test was the defect, and it is fixed rather than
+disabled, weakened or skipped.
+
+---
+
+## 1. The failure
+
+```
+../modules/net/tests/System/Net/DnsLiteralAndDuplicateTests.cpp:102: Failure
+Expected: (void)Dns::GetHostAddresses(text) throws an exception of type SocketException.
+  Actual: it throws nothing.
+1.2.3.
+```
+
+Reproducible 5 runs out of 5, and reproducible **with the working tree stashed** — so it is not a
+regression from the change that was in flight (#1929, which touches only `modules/core` date and
+time parsing and cannot reach `modules/net`).
+
+## 2. What was actually happening
+
+The test asserted that six strings *fail to resolve*. That is not a property of this port. It is
+the **resolver's** opinion, and any wildcard DNS server can change it.
+
+Measured on this container:
+
+| Text | Answer | Time |
+|---|---|---|
+| `"1.2.3"` | `1.2.0.3` | **0.03 ms** — libc's digits-and-dots shortcut, no network |
+| `"1.2.3."` | `1.2.0.3` | **13.39 ms** — a DNS round trip to `10.28.9.85` |
+| `"definitely-not-a-real-host-xyz123."` | fails | 36.65 ms |
+
+The trailing dot makes it a fully-qualified name, so libc declines the shortcut
+(`inet_aton("1.2.3.")` fails, verified) and asks the configured nameserver, which answers. .NET's
+`Dns.GetHostAddresses` calls the same `getaddrinfo` on Linux and would return the same address.
+
+The file's own header claimed *"These tests use only IP literals and names this container
+resolves from `/etc/hosts`, so none of them needs a network."* That sentence was measured false
+for exactly this row, and it is now corrected in place rather than left standing.
+
+This is the same shape as two earlier findings: #2320's rows that passed only because this
+machine has a `~/Desktop`, and #2351's rows that hard-coded a tzdata version. `docs/StandingApprovals.md`
+SA-6 calls a test that passes only because of a machine property a defect **in the test**.
+
+## 3. The repair
+
+Two assertions replace one, and neither depends on the resolver:
+
+1. **`IPAddress::TryParse` must reject the text.** This is the whole of SR-AUD-304 — the finding
+   was that `Dns` had a *second, disagreeing* IPv4 parser that gave malformed text a literal
+   reading. That claim holds on every machine.
+2. **Whatever happens next must match an independent oracle.** The test calls `getaddrinfo`
+   itself, through a different door, and requires `Dns::GetHostAddresses` to agree: throw
+   `SocketException` when the resolver has no answer, and otherwise return exactly the resolver's
+   address set. This is the oracle pattern #2351 established for tzdata.
+
+The oracle is POSIX-only and `#ifdef`-guarded; on Windows assertion 1 still runs.
+
+## 4. Why this is stronger, not weaker
+
+The old test could only ever fail in two ways: the port invents a literal (the real defect), or
+the resolver changes its mind (noise). The new one keeps the first and removes the second, and it
+adds a check the old one could not express — that a *successful* resolution is reported
+faithfully, with no fabricated entries and no duplicates.
+
+Mutation evidence:
+
+| Mutation | Caught |
+|---|---|
+| Return an empty vector instead of raising on resolution failure | ✅ (also by `SignedAndSpacedIPv4Text_IsRejected`) |
+| Give malformed text a literal reading by trimming trailing `' '`/`'.'` | ✅ |
+
+The test count does not move: one test is rewritten, not added.

modules/net/tests/System/Net/DnsLiteralAndDuplicateTests.cpp

@@ -26,6 +26,14 @@
 //
 // These tests use only IP literals and names this container resolves from /etc/hosts, so none
 // of them needs a network. The one place a real DNS answer would be required is guarded.
+//
+// CORRECTION (ticket #2375, 2026-08-18): that sentence was measured false for exactly one row.
+// MalformedLiteralTextIsStillRejected asserted that six strings fail to resolve, which is not a
+// property of this port at all -- it is the RESOLVER's opinion, and any wildcard DNS server can
+// change it. On this container "1.2.3." takes a 13 ms round trip and comes back as 1.2.0.3,
+// where "1.2.3" is answered by libc in 0.03 ms. The test now asks getaddrinfo itself and
+// requires the port to AGREE with it, which is the property #2039 was actually about and is
+// independent of what any resolver answers. See docs/DnsLiteralOracleTestDefect.md.
 #include <gtest/gtest.h>
 #include "System/ArgumentException.hpp"
 #include <algorithm>
@@ -37,6 +45,11 @@
 #include "System/Net/Sockets/AddressFamily.hpp"
 #include "System/Net/Sockets/SocketError.hpp"
 #include "System/Net/Sockets/SocketException.hpp"
+#ifndef _WIN32
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <sys/socket.h>
+#endif
 
 using System::Net::Dns;
 using System::Net::IPAddress;
@@ -97,9 +110,81 @@ TEST(DnsLiteralTests, LiteralIsInterpretedExactlyAsIPAddressParseDoes) {
     }
 }
 
-TEST(DnsLiteralTests, MalformedLiteralTextIsStillRejected) {
+// An independent oracle, in the shape #2351 established for tzdata: ask the system
+// resolver the same question through a different door, and require the port to give
+// the same answer. Nothing here asserts what that answer IS.
+namespace {
+struct ResolverAnswer {
+    bool                     resolved = false;
+    std::vector<std::string> addresses;
+};
+
+ResolverAnswer askTheSystemResolver(const char* text) {
+    ResolverAnswer answer;
+#ifdef _WIN32
+    (void)text;   // the oracle is POSIX-only; see the guard at the call site
+#else
+    ::addrinfo hints{};
+    hints.ai_family   = AF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+    ::addrinfo* head  = nullptr;
+    if (::getaddrinfo(text, nullptr, &hints, &head) != 0 || head == nullptr) return answer;
+    answer.resolved = true;
+    for (::addrinfo* it = head; it != nullptr; it = it->ai_next) {
+        char buffer[INET6_ADDRSTRLEN] = {};
+        if (it->ai_family == AF_INET) {
+            ::inet_ntop(AF_INET,
+                        &reinterpret_cast<::sockaddr_in*>(it->ai_addr)->sin_addr,
+                        buffer, sizeof(buffer));
+        } else if (it->ai_family == AF_INET6) {
+            ::inet_ntop(AF_INET6,
+                        &reinterpret_cast<::sockaddr_in6*>(it->ai_addr)->sin6_addr,
+                        buffer, sizeof(buffer));
+        } else {
+            continue;
+        }
+        answer.addresses.emplace_back(buffer);
+    }
+    ::freeaddrinfo(head);
+#endif
+    return answer;
+}
+} // namespace
+
+// FLIPPED by #2375 (2026-08-18). This used to assert that six strings throw, which made the
+// suite depend on the container's DNS. What the port actually owes is narrower and testable:
+// text that IPAddress::Parse rejects must never be given a literal reading, and the answer
+// must be whatever the system resolver says -- including "nothing", which is what most
+// resolvers say about most of these.
+TEST(DnsLiteralTests, MalformedLiteralTextIsNeverGivenALiteralReading) {
     for (const char* text : {"1.2.3.4.5", "1.2.3.", "256.1.1.1", "1.2.3.4 ", "", "999.999.999.999"}) {
-        EXPECT_THROW((void)Dns::GetHostAddresses(text), SocketException) << text;
+        // 1. The port must not read any of these as a literal. This is the whole finding,
+        //    and it holds on every machine.
+        IPAddress parsed;
+        EXPECT_FALSE(IPAddress::TryParse(text, parsed)) << text;
+
+#ifdef _WIN32
+        // No oracle here; the literal claim above is still checked.
+        continue;
+#else
+        // 2. Whatever happens next is the resolver's business, and the port must report it
+        //    faithfully rather than inventing an answer.
+        const ResolverAnswer oracle = askTheSystemResolver(text);
+        if (!oracle.resolved) {
+            EXPECT_THROW((void)Dns::GetHostAddresses(text), SocketException) << text;
+            continue;
+        }
+        std::vector<std::string> got;
+        ASSERT_NO_THROW({
+            for (const IPAddress& address : Dns::GetHostAddresses(text))
+                got.push_back(address.ToString());
+        }) << text;
+        std::vector<std::string> expected = oracle.addresses;
+        std::sort(expected.begin(), expected.end());
+        expected.erase(std::unique(expected.begin(), expected.end()), expected.end());
+        std::sort(got.begin(), got.end());
+        EXPECT_EQ(got, expected) << text;
+#endif
     }
 }
 

modules/net/tests/System/Net/DnsTests.cpp

@@ -141,25 +141,37 @@ TEST(DnsTests, GetHostEntry_ByAddress_IPv6Loopback_ResolvesSomeName) {
 //
 // The addresses below are the RFC 5737 TEST-NET-1 and RFC 3849 documentation ranges, which are
 // reserved precisely so that they resolve to nothing anywhere, so this exercises the
-// no-reverse-mapping branch even on a host that does have an ::1 entry. The assertion is that
-// the call TERMINATES and reports the address it was asked about; a host that does return a
-// name for these is free to do so, and the entry is then whatever that name resolves to.
+// no-reverse-mapping branch even on a host that does have an ::1 entry.
+//
+// CORRECTION (ticket #2375, 2026-08-18). This used to require that the call RETURN an entry,
+// which is a third possible outcome the resolver gets to choose among, not a property of this
+// port. Caught by the full gate: one run raised `Temporary failure in name resolution`
+// (EAI_AGAIN) for 192.0.2.1 while five isolated runs passed. The finding is about
+// TERMINATION -- an unbounded mutual recursion overflows the stack and takes the process
+// down, so it can neither return nor throw -- and termination is what is asserted now.
+// A resolver that answers, one that says "no such name", and one that is briefly unreachable
+// are all acceptable; a stack overflow is not.
 TEST(DnsTests, GetHostEntry_ByAddress_WithNoReverseMapping_TerminatesInsteadOfRecursing) {
-    const IPAddress documentationV4 = IPAddress::Parse("192.0.2.1");
-    const IPHostEntry v4 = Dns::GetHostEntry(documentationV4);
-    EXPECT_FALSE(v4.getHostNameProperty().empty());
-    if (v4.getHostNameProperty() == documentationV4.ToString()) {
-        ASSERT_EQ(v4.getAddressListProperty().size(), 1u);
-        EXPECT_EQ(v4.getAddressListProperty()[0], documentationV4);
-    }
-
-    const IPAddress documentationV6 = IPAddress::Parse("2001:db8::1");
-    const IPHostEntry v6 = Dns::GetHostEntry(documentationV6);
-    EXPECT_FALSE(v6.getHostNameProperty().empty());
-    if (v6.getHostNameProperty() == documentationV6.ToString()) {
-        ASSERT_EQ(v6.getAddressListProperty().size(), 1u);
-        EXPECT_EQ(v6.getAddressListProperty()[0], documentationV6);
-    }
+    const auto terminatesForAddressLiteral = [](const char* text) {
+        const IPAddress address = IPAddress::Parse(text);
+        try {
+            const IPHostEntry entry = Dns::GetHostEntry(address);
+            // The resolver answered. Whatever it said, the entry must be well formed.
+            EXPECT_FALSE(entry.getHostNameProperty().empty()) << text;
+            if (entry.getHostNameProperty() == address.ToString()) {
+                // No reverse mapping: the port reports the address it was asked about,
+                // exactly once, rather than calling back in with it.
+                ASSERT_EQ(entry.getAddressListProperty().size(), 1u) << text;
+                EXPECT_EQ(entry.getAddressListProperty()[0], address) << text;
+            }
+        } catch (const SocketException&) {
+            // The resolver declined, or was momentarily unreachable. Reaching this line is
+            // itself the assertion: the call came back.
+            SUCCEED();
+        }
+    };
+    terminatesForAddressLiteral("192.0.2.1");
+    terminatesForAddressLiteral("2001:db8::1");
 }
 
 // The same termination guarantee for the loopback addresses the suite already uses, stated as