This is very likely caused by something janky my ISP (AT&T) is doing with IPv6, but the above named test fails for me because IPv6 addresses like `::1q` do not fail to resolve as the test expects.

I'm not sure what can or should be done about it, but as this is an annoying local failure, and I couldn't find another mention of it by searching bpo, I wanted to at least get it on record.

The test function's comment says:

"
        # These are all malformed IP addresses and expected not to resolve to
        # any result.  But some ISPs, e.g. AWS, may successfully resolve these
        # IPs.
"

So apparently, put AT&T in that bucket of ISPs that resolve those IPv6 addresses.

Woot!  I finally figured out the problem and how to fix it.  It has nothing to do with Python and everything to do with AT&T.  They run a service called DNS Error Assist, quoting:

"Sometimes we enter a wrong search word, or a wrong web address, or maybe the website we want is no longer in service. If this happens, the DNS Error Assist service automatically searches for similar or related terms and presents you some results that may be useful for you. Otherwise, you’ll get a “No results found” error message."

Turning this off is buried in AT&T's site.  I found some outdated recommendations on the web, but here's what worked for me (as of the date of this comment).

Log in to your AT&T portal, search for "Privacy" and click on the link that says "Privacy in Support".  This takes you to a page that describes AT&T's privacy policies, and gives you a link to "Go" to your privacy settings.

From there you should see two sections, one that says "Control how we communicate with you" and one that says "Control how we use your data".  Select DNS Error Assist and disable that.  You'll need to wait a few minutes for it to take effect, but then you'll get none of those bogus resolutions.

While you're at it, you might want to review your other privacy settings.

Rule #1 for home users:  Never use your ISPs DNS.  Always configure a reputable one in your router.  If you can't control your router, configure your computer to ignore the router's DNS.

Classic best in breed non-ISP servers exist: 8.8.8.8 (google), 9.9.9.9 (quad9), 1.1.1.1 (cloudflare?), etc.

ISPs often monetize DNS in nefarious ways.  If they control the router they can even decide to have it subvert those settings as DNS is unencrypted UDP so it can be redirected/intercepted/modified.  Avoiding that requires using DoH or DoT (DNS over HTTPS/TLS) but configuring that is way beyond what I'm capable of quipping in a box this small. :)