Thanks for reporting this. I'm hunting down the problem, which seems to be an edge case I missed when implementing the exclusion trie merging code. Specifically, it seems that if the address part of a CIDR spec falls within a CIDR spec already in the trie, we end up doing the wrong thing, probably when we assume this means the earlier spec is the larger one. For example, if you use a different pair of specs such that the base address of the larger spec does not fall within the smaller one, the bug doesn't trigger: 192.168.1.128/25 and 192.168.1.0/24, for instance.

Bug is in this section:

   if (this->mask[i] > mask[i]) {
        /* broader mask, truncate this one */
        this->mask[i] = mask[i];
        for (; i < 4; i++) {
          this->mask[i] = 0;
        }

We correctly take the new, broader mask for this u32 (in the case of IPv4, that's the entire mask), but then we set each u32 in the mask to 0. We should skip the current one since we already grabbed the correct value.

I'm actually rewriting a few portions of this to do the work in trie_split() instead, since that is going to be a bit more efficient. Will update this issue when I push a fix.