Lou,
The netscan command [1] uses pool tag scanning like connscan [2]. Thus it has the same pros/cons described - in particular "This can find artifacts from previous connections that have since been terminated, in addition to the active ones. In the output below, you'll notice some fields have been partially overwritten, but some of the information is still accurate."
In other words, you may have found remnants of a connection that was once established, but was closed before the memory dump was taken. The structure is still lingering, but some pointers within the structure (namely those that identify the owning process) are no longer valid.
HTH,
Michael