The report and others are calling this "cache poisoning". That's a misnomer. It is not cache poisoning in the long-standing sense of the phrase. It is very simply equally long-standing simple DNS/UDP brute force response forgery.

* https://github.com/Avunit/Dnsmasq-Cache-Poisoning/blob/main/...

They're also relying upon the random source port being allocated from a subset of the available port range, 32768 to 61000 in their default setting.

The claim in the code is that it is Google Public DNS that is failing to respond to queries where the domain name has had an extra label prepended, and that label is 1 character long and the character is a tilde.

Google Public DNS has no such non-response problems with ~.www.example.com in my part of the world.

However, note that they are injecting the forged responses from the very same machine that sent the initial query to dnsmasq, with no delay whatsoever. Whereas it takes Google Public DNS a second or so to look up ~.www.example.com here. So really there's no methodologically sound evidence that Google Public DNS even has the fault with these punctuation characters as claimed.