It turns out it is breaking httpapi tests, Testbot failures are not random. I additionally tested now that binding to any address after loopback behaves the same way as in reverse order (for which there is a test already): it currently allows even more on Windows (listen too) than we do.
So the change introduced by this patch is not wrong, although httpapi currently relies on the old behaviour in this aspect. I think it can be fixed in httpapi by using SO_EXCLUSIVEADDRUSE socket option: I tested that using it even on the second socket only (without setting on the first bound socket), in particular, denies binding to any addr once specific address is already bound. This option should be implemented in Winsock first.
My suggestion for now is to add todo to the test and follow up with SO_EXCLUSIVEADDRUSE implementation in winsock and using that in http.sys. I think it should be doable for sockets with SO_EXCLUSIVEADDRUSE on top of the bound address tracking introduced in this patchset. Just doing this at once will further complicate already long and not quite trivial patch from here, and the patch series is not too short already. Meanwhile this can't be done before the address tracking logic is in place.
v3: - Add test with binding loopback addr before any addr; - Add todo_wine to failing httpapi tests.