ControlConnection#fetchNodeInfo currently does the following:
if the hosts's broadcast_address is known, select from system.peers where peer = broadcast_address
otherwise, select * from system.peers, and look for a row where rpc_address matches host.address
There is an edge case where the broadcast_address address could be known but invalid. So it makes sense to fallback to step 2 if step 1 finds no row. See this pull request for more details and a patch.