Applied patch from David http://seclists.org/nmap-dev/2012/q2/5

scripts/dns-ip6-arpa-scan.nse

@@ -13,7 +13,7 @@ http://7bits.nl/blog/2012/03/26/finding-v6-hosts-by-efficiently-mapping-ip6-arpa
 
 ---
 -- @usage
--- nmap --script dns-ip6-arpa-scan --script-args='prefix=2001:0DB8,mask=48'
+-- nmap --script dns-ipv6-arpa-scan --script-args='prefix=2001:0DB8,mask=48'
 --
 -- @output
 -- Pre-scan script results:
@@ -38,11 +38,14 @@ local arg_mask = stdnse.get_script_args(SCRIPT_NAME .. ".mask")
 
 prerule = function() return (arg_prefix ~= nil and arg_mask ~= nil) end
 
-local function query_prefix(query, result)
+local pending = {}
+local result = {}
+
+local function query_prefix(query)
 	local condvar = nmap.condvar(result)
 	local status, res = dns.query(query, { dtype='PTR' })
 	if ( not(status) and res == "No Answers") then
-		table.insert(result, query)
+		table.insert(pending, query)
 	elseif ( status ) then
 		local ip = query:sub(1, -10):gsub('%.',''):reverse():gsub('(....)', '%1:'):sub(1, -2)
 		ip = ipOps.bin_to_ip(ipOps.ip_to_bin(ip))
@@ -64,12 +67,11 @@ action = function()
 
 	local i = 20
 
-	local result
 	repeat
-		result = {}
+		pending = {}
 		for _, f in ipairs(found) do
 			for q in ("0123456789abcdef"):gmatch("(%w)") do
-				local co = stdnse.new_thread(query_prefix, q .. "." .. f, result)
+				local co = stdnse.new_thread(query_prefix, q .. "." .. f)
 				threads[co] = true
 			end
 		end
@@ -82,11 +84,11 @@ action = function()
 			end
 		until( next(threads) == nil )
 			
-		if ( 0 == #result ) then
-			return
+		if ( 0 == #pending ) then
+			break
 		end
 				
-		found = result
+		found = pending
 		i = i + 1
 	until( 128 == i * 2 + arg_mask )