I think either 400 or 404 would be fine. 400 because the request isn't in the expected format, 404 because a resource with that query string doesn't exist.
I shy from 404 because the resource itself may be valid, it's the query parameters which aren't acceptable. Returning 404 could result in some remote processes, particularly Web crawlers, incorrectly marking the base resource as unavailable, which may not be desirable.