DADR is only valid when DNET is specified (i.e. net is non-zero).

bacnet-stack/include/bacdef.h

@@ -60,7 +60,7 @@
 /* FIXME: mac[] only needs to be as big as our local datalink MAC */
 #define MAX_MAC_LEN 7
 struct BACnet_Device_Address {
-    /* mac_len = 0 if global address */
+    /* mac_len = 0 is a broadcast address */
     uint8_t mac_len;
     /* note: MAC for IP addresses uses 4 bytes for addr, 2 bytes for port */
     /* use de/encode_unsigned32/16 for re/storing the IP address */

bacnet-stack/src/bip.c

@@ -166,8 +166,8 @@ int bip_send_pdu(
 
     mtu[0] = BVLL_TYPE_BACNET_IP;
     bip_dest.sin_family = AF_INET;
-    if (dest->net == BACNET_BROADCAST_NETWORK 
-		|| dest->len == 0
+    if (dest->net == BACNET_BROADCAST_NETWORK
+		|| ((dest->net > 0) && (dest->len == 0))
 		|| dest->mac_len == 0) {
         /* broadcast */
         address.s_addr = BIP_Broadcast_Address.s_addr;

bacnet-stack/src/bvlc.c

@@ -1140,8 +1140,12 @@ int bvlc_send_pdu(
     /* bip datalink doesn't need to know the npdu data */
     (void) npdu_data;
     mtu[0] = BVLL_TYPE_BACNET_IP;
-	if ( dest->net == BACNET_BROADCAST_NETWORK 
-		|| dest->len == 0
+    /* handle various broadcasts: */
+    /* mac_len = 0 is a broadcast address */
+    /* net = 0 indicates local, net = 65535 indicates global */
+    /* net > 0 and net < 65535 are network specific broadcast if len = 0 */
+	if ( dest->net == BACNET_BROADCAST_NETWORK
+		|| ((dest->net > 0) && (dest->len == 0))
 		|| dest->mac_len == 0) {
         /* if we are a foreign device */
         if (Remote_BBMD.sin_port) {