net: IPMask.MarshalText silently returns empty output for masks that are not 4 or 16 bytes long #81749

net.IPMask.MarshalText gained a new text format in the Go 1.28 cycle (issue #29678), gated behind GODEBUG=netmarshal=1. For a mask whose length is not 0, 4, or 16 bytes, the new path returns empty bytes with a nil error instead of an error, and the data is silently destroyed:

m := net.IPMask{255, 255, 255, 0, 1}
b, err := m.MarshalText()  // GODEBUG=netmarshal=1: b="", err=nil
j, _ := json.Marshal(m)    // j = ""
var m2 net.IPMask
json.Unmarshal(j, &m2)     // m2 = [] -- the original 5 bytes are gone

(The old base64 format round-trips the same mask fine.)

Root cause in src/net/ip.go:

addr, _ := netip.AddrFromSlice(m)
return addr.AppendTo(nil), nil

The ok result is discarded; on failure addr is the zero Addr and AppendTo(nil) yields nothing. The sibling IP.MarshalText returns an honest error (address 0102030405: invalid IP address) for invalid lengths, so this is also internally inconsistent. The existing ipMaskJSONTests table only covers nil/4-byte/16-byte masks, which is why it slipped through.

Expected: MarshalText returns a non-nil error for a mask that cannot be represented as an IP address.

Seen on master at 8190b02c (2026-09-25), linux/amd64, go1.28-devel.