ResolveCNAME/ResolveIPs cached negative results as an empty Result but the cache-hit path returned (empty, true), so enrichHost did chain[1:] on a zero-length slice and the process panicked (exit 2). Negative cache hits now return false, plus a defensive length guard in enrichHost and a regression test.