I think either 400 or 404 would be fine. 400 because the request isn't in the expected format, 404 because a resource with that query string doesn't exist.

> 409" ("Conflict") which is largely for WebDAV requests.

I’ve always used them in API servers when a client was POSTing to create a duplicate of a unique item.

Just fire off a 200 OK with text body of "499 Bad query string"

Im not making this up btw. A old NOC I woeked at emitted every error as 200 OK with the body message with the real error. They were a real shitshow.

I'm willing to pay them $1 for a contact guaranteeing that they won't service such requests. That would make 451 the most appropriate.