to reproduce:
ipnet=foo0 ip=192.168.0.0 ipmask=/16
ipnet=foo1 ip=192.168.0.0 ipmask=/24
ip=192.168.0.1 sys=foo2
% ndb/ipquery sys foo2 ipnet ipmask
ipnet=foo0 ipmask=/16
we would expect to get ipnet=foo1 here as it is more
specific subnet.
the solution is to order the subnets by prefix length
in subnet() before calling filter(), so that we process
the longest prefixes first.