When you start X -query IP (without -from) on a machine with at least 256 nonlocal IP addresses an arithmetic overflow followed by an out-of-bounds write occurs during the 256th invocation of XdmcpRegisterConnection() (xserver/tree/os/xdmcp.c) when it tries to add more data to ConnectionAddresses:

1. the reallocation extends the array to 256 entries but the new value of ConnectionAddresses.length will be zero because its type is CARD8:
    if (!XdmcpReallocARRAYofARRAY8 (&ConnectionAddresses,
				    ConnectionAddresses.length +  1))

2. the assignment of new data writes to "index -1" and corrupts the heap, making the process ready to go down in flames:
    ConnectionAddresses.data[ConnectionAddresses.length-1].data = newAddress;
    ConnectionAddresses.data[ConnectionAddresses.length-1].length = addrlen;