When managing an ENS name, if you click the Transfer button on the registrant and then enter an ENS subdomain (e.g., red.apple.fruit.eth) into the address entry box it resolves to address 0x000… rather than the name setup in the resolver for that subdomain.
Note: Entering a root domain (e.g., fruit.eth) into the entry box correctly resolves the name and populates a full address.
Note 2: I only tested with a 4-level deep ENS name. I own <second>.eth, which has a subdomain of <third>.<second>.eth which has NO records set, but does have a resolver and a subdomain of <fourth>.<third>.<second>.eth. <fourth>.<third>.<second>.eth has a resolver set as well as an Address record and an Other Addresses record but no reverse record set.