Indeed, arma was right. There was one ntohl too many in debug_ntop in eventdns.c