D.Msg.PackBuffer sizes its scratch space by the uncompressed message length
and silently allocates a new slice when that exceeds the given buffer, even
though the compressed result would fit. The udp hijack path in
listener/sing_tun/dns.go always sends the original buffer, producing a
correct-length datagram full of zeros or stale bytes whenever a reply's
uncompressed size exceeds SafeDnsPacketSize (e.g. 100+ A records for one
name). Copy the packed result back into the caller's buffer when it fits.
The tcp path in RelayDnsConn already guards against this; the udp path did
not.
TWO666
fb002210ff