We allow */bits as an address-and-mask pattern
When parsing bitmasks for policies, we allow a number of bits along with the "*" catch-all address. That's not what our specs say we allow, and it doesn't make any sense. We should treat it as a bad address-and-mask.
(If anybody is using this now, we might need to deprecate it instead of disabling it, but I don't think anyone is.)