The vulnerable path was DNSPacket::DecodeInternal, which is invoked to decode a DNS response into aTypeResult but never reset aTypeResult to Nothing() at entry. When the same DNSPacket/output slot was reused across decodes — or a later decode failed or contained no matching type record — the aTypeResult variant retained the type record accumulated by a previous decode. This violated the invariant that a decode’s output must reflect only the packet being parsed for the current request, so a stale record from one lookup could be surfaced as the answer for another.

The fix adds aTypeResult = mozilla::AsVariant(Nothing()); immediately after clearing aCname, guaranteeing the typed result starts empty on every call. Because the reset happens before any early-return error path (aLen < 12, etc.), no leftover record can survive a decode that does not legitimately produce one.

An attacker can cause a DNS type record resolved in one context to be surfaced as the result of an unrelated resolution, producing a same-origin-policy bypass in the DNS/networking layer of the browser process. The severity is moderate: it requires the reuse of the decode path across resolutions where the second response lacks its own type record, and yields disclosure/confusion of resolved record data rather than direct memory corruption.