diff --git a/CHANGELOG.md b/CHANGELOG.md
index d14cfee1..6054e0ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -71,6 +71,8 @@ In this release, the schema version has changed from 27 to 28.
 
 ### Fixed
 
+- “Invalid AddrPort” in the *Private reverse DNS servers* section on the
+  *Settings → DNS settings* page.
 - Panic on using `--no-etc-hosts` flag ([#6644]).
 - Schedule display in the client settings after creating or updating.
 - Zero value in `querylog.size_memory` disables logging ([#6570]).
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index 2da21391..9c0097b9 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -83,7 +83,9 @@ type DHCP interface {
 
 // SystemResolvers is an interface for accessing the OS-provided resolvers.
 type SystemResolvers interface {
-	// Addrs returns the list of system resolvers' addresses.
+	// Addrs returns the list of system resolvers' addresses.  Callers must
+	// clone the returned slice before modifying it.  Implementations of Addrs
+	// must be safe for concurrent use.
 	Addrs() (addrs []netip.AddrPort)
 }
 
diff --git a/internal/dnsforward/http.go b/internal/dnsforward/http.go
index d3d352df..2c222d07 100644
--- a/internal/dnsforward/http.go
+++ b/internal/dnsforward/http.go
@@ -218,7 +218,7 @@ func (s *Server) defaultLocalPTRUpstreams() (ups []string, err error) {
 		return nil, err
 	}
 
-	sysResolvers := slices.DeleteFunc(s.sysResolvers.Addrs(), matcher.Has)
+	sysResolvers := slices.DeleteFunc(slices.Clone(s.sysResolvers.Addrs()), matcher.Has)
 	ups = make([]string, 0, len(sysResolvers))
 	for _, r := range sysResolvers {
 		ups = append(ups, r.String())