To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.