the bug only exists in the XP version of UPNP.

Customers using Microsoft® Windows® ME or XP, or who have installed the Windows XP Internet Connection Sharing client on Windows 98 or 98SE.

From the above quote from Microsoft (and looking at their technical details), it sounds like it's part of the ICS, and uPnP is part of it. For some reason it only affects 98 if the ICS client was installed from an XP server. SE did ship with ICS, so aparently whatever changes were made to it when it went to ME is where the problem occured. ME shipped by default with nothing on that would use it, but XP does.

2000's ICS was completly different in that it was more NAT based compaired to the 98/ME/XP solutions.