Merge maint into master, carrying two fixes from fr34aky

The invalid-hostname test now resolves an absolute name, so a wildcard search domain cannot answer it, and the FreeBSD package README uses version placeholders in place of a stale concrete version. Both apply to master unchanged.

packaging/freebsd/README.md

@@ -18,13 +18,14 @@ not compiled pending FreeBSD-specific `SO_REUSEPORT` validation.
 ./packaging/freebsd/build-pkg.sh --no-build # package existing release binaries
 ```
 
-Output: `deploy/fips-<version>-freebsd-<arch>.pkg` (e.g.
-`fips-0.5.1.dev-freebsd-amd64.pkg` — pkg versions cannot contain `-`).
+Output: `deploy/fips-<version>-freebsd-<arch>.pkg`. pkg versions cannot
+contain `-` or `+`, so both are mapped to `.`: a Cargo version of
+`<x.y.z>-dev` becomes `fips-<x.y.z>.dev-freebsd-amd64.pkg`.
 
 ## Install
 
 ```sh
-pkg add ./deploy/fips-0.5.1-freebsd-amd64.pkg
+pkg add ./deploy/fips-<version>-freebsd-<arch>.pkg
 # post-install seeds this from the sample if absent, at mode 0600
 vi /usr/local/etc/fips/fips.yaml
 sysrc fips_enable=YES fips_dns_enable=YES

src/transport/udp/mod.rs

@@ -1029,7 +1029,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_resolve_socket_addr_invalid() {
-        let invalid = TransportAddr::from_string("nonexistent.invalid:2121");
+        let invalid = TransportAddr::from_string("nonexistent.invalid.:2121");
         assert!(resolve_socket_addr(&invalid).await.is_err());
 
         let binary = TransportAddr::new(vec![0xff, 0x80]);