networksetup

On the far side of a macOS admin prompt, a free-text DNS field ran commands as root

Sonar's developer routed a custom resolver string straight into the arguments of a privileged networksetup call. He found it himself, in a pre-version-2 pass that produced twenty-six fixes, four of which he describes.