Names in DNS packets are "compressed" by encoding repeated labels ("google.com" in a Google A query) as offsets to the first place in the packet the label was seen. The offset encoding allows 14 bits for the actual integer.
Dempsky's bug causes DJB's code to attempt to compress a name whose suffix is first seen more than 16384 bytes into the packet, which rolls that counter, which throws off the rest of the parse and allows data that should be junk inside a record to instead be parsed as a seperate record.
This is the second integer-related security flaw in DJB's code (and apparently the first exploitable one). Integer handling in C code is hard to get right; there are lots of corner cases, but more importantly there are lots of sites in your code you have to check at, unlike buffer overflows, which are almost always sited at your (relatively infrequent) buffer copies.