{"record":{"id":"743366bbbce07a0e","repo":"zeroclaw-labs/zeroclaw","slug":"blocked-host-host-resolved-to-v6-which-the","errorCode":null,"errorMessage":"Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix {prefix} translates to non-global address {embedded}","messagePattern":"Blocked host '(.+?)' resolved to (.+?), which the configured NAT64 prefix (.+?) translates to non-global address (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-infra/src/net_guard.rs","lineNumber":859,"sourceCode":"    if ips.is_empty() {\n        anyhow::bail!(\"Failed to resolve host '{host}'\");\n    }\n\n    for ip in ips {\n        if is_cloud_metadata_ip(*ip) {\n            return Err(metadata_block_error(host, *ip));\n        }\n\n        if let std::net::IpAddr::V6(v6) = ip {\n            // Overlapping prefixes translate one address to several different\n            // destinations. Every one of them is reachable, so the address is\n            // accepted only when all of them are acceptable.\n            for (prefix, embedded) in network_specific_embedded_ipv4s(*v6, nat64_prefixes) {\n                if is_cloud_metadata_ip(std::net::IpAddr::V4(embedded)) {\n                    return Err(nat64_metadata_block_error(host, *v6, prefix, embedded));\n                }\n                if is_non_global_v4(embedded) {\n                    anyhow::bail!(\n                        \"Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix \\\n                         {prefix} translates to non-global address {embedded}\"\n                    );\n                }\n            }\n        }\n\n        let non_global = match ip {\n            std::net::IpAddr::V4(v4) => is_non_global_v4(*v4),\n            std::net::IpAddr::V6(v6) => is_non_global_v6(*v6),\n        };\n        if non_global {\n            anyhow::bail!(\"Blocked host '{host}' resolved to non-global address {ip}\");\n        }\n    }\n\n    Ok(())\n}","sourceCodeStart":841,"sourceCodeEnd":877,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-infra/src/net_guard.rs#L841-L877","documentation":"Error \"Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix {prefix} translates to non-global address {embedded}\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-infra/src/net_guard.rs:859 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the host from the allowlist or add the NAT64-translated non-global address range to allowed private hosts; do not bypass the guard silently."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}