Disaster recovery solution for MySQL
Active-Passive master-master is a good setup but I have seen SUPER (humans)users writing on slave without setting sql_log_bin. 
(Though super_read_only in 5.7 will change things around this.)

Anyways, following is possible and works.

ProdActiveMaster&lt;----&gt;ProdPassiveMaster
|
|
|
\/
DRmaster-----&gt;DRSlave


So you know now that another master-master setup is not possible as DRMaster cannot replicate from two masters.
I doubt multi-source replication is a solution here as it will create more trouble than help.

You need to make sure to keep your DRSlave, "master-ready"... setting auto_increment% and binlog + logslaveupdates settings.