XX-10788:  dn_expand requires the second argument to point to the end of the msg pointer.  However the old implementation simply hard codes it as msg+512 which can overrun the buffer.  This results to unknown behavior for dn_expand which sometimes returns -1 for a perfectly formatted msg.