BUG: fix+test assigning invalid NAT-like to DTA/TDA/PA
Broken off from #27311 for cleaner scope and to troubleshoot platform-specific failures.  Related but orthogonal to #27323.
comments addressed i think