render: on macOS the context function's advertised 127.0.0.1:PORT can reach another process's listener (TestListenerRoundTrip flakes)

// Listens like contextfn.Start (":0"), then lets a second listener bind
// 127.0.0.1 on the same port, then dials the advertised target
// 127.0.0.1:PORT and reports which listener accepted the connection.
package main

import (
	"fmt"
	"net"
	"time"
)

func try(first string) {
	a, err := net.Listen("tcp", first)
	if err != nil {
		panic(err)
	}
	defer a.Close()
	port := a.Addr().(*net.TCPAddr).Port

	b, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
	if err != nil {
		fmt.Printf("listen %-12q -> %s; then listen 127.0.0.1:%d -> %v\n", first, a.Addr(), port, err)
		return
	}
	defer b.Close()

	got := make(chan string, 2)
	go func() { if _, err := a.Accept(); err == nil { got <- "the first listener" } }()
	go func() { if _, err := b.Accept(); err == nil { got <- "the SECOND listener" } }()
	c, err := net.Dial("tcp", fmt.Sprintf("127.0.0.1:%d", port))
	if err != nil {
		panic(err)
	}
	defer c.Close()
	select {
	case w := <-got:
		fmt.Printf("listen %-12q -> %s; then listen 127.0.0.1:%d -> ok; dial 127.0.0.1:%d reached %s\n", first, a.Addr(), port, port, w)
	case <-time.After(2 * time.Second):
		fmt.Println("no accept")
	}
}

func main() {
	try(":0")
	try("127.0.0.1:0")
}

macOS:

$ go run .
listen ":0"         -> [::]:52543; then listen 127.0.0.1:52543 -> ok; dial 127.0.0.1:52543 reached the SECOND listener
listen "127.0.0.1:0" -> 127.0.0.1:52545; then listen 127.0.0.1:52545 -> listen tcp 127.0.0.1:52545: bind: address already in use

Linux (arm64, in a container):

listen ":0"         -> [::]:43583; then listen 127.0.0.1:43583 -> listen tcp 127.0.0.1:43583: bind: address already in use
listen "127.0.0.1:0" -> 127.0.0.1:44079; then listen 127.0.0.1:44079 -> listen tcp 127.0.0.1:44079: bind: address already in use

--- FAIL: TestListenerRoundTrip (0.06s)
    listener_test.go:60: RunFunction: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: http2: failed reading the frame payload: http2: frame too large, note that the frame header looked like an HTTP/1.1 header"
        pid=42477 lsof:
        COMMAND     PID             USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
        steve      9356 me    7u  IPv4 0x1762ec606a975469      0t0  TCP 127.0.0.1:49574 (LISTEN)
        probe-con 42477 me    4u  IPv6 0xc9c60a2a9dce0c78      0t0  TCP *:49574 (LISTEN)
FAIL
--- FAIL: TestListenerRoundTrip (2.06s)
    listener_test.go:60: RunFunction: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: EOF"
        pid=42486 lsof:
        COMMAND     PID             USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
        limactl    4651 me    9u  IPv4 0x4e3222da67fe7a05      0t0  TCP 127.0.0.1:49340 (LISTEN)
        probe-con 42486 me    4u  IPv6 0xc5d00989bf2fe556      0t0  TCP *:49340 (LISTEN)
FAIL

A host program opened a ":0" listener, optionally a second 127.0.0.1:PORT listener, then ran docker run --rm alpine nc host.docker.internal PORT:

shadow=false port=51120 accepted by: contextfn-style listener [::]:51120 (remote 127.0.0.1:51122)
container output: nc exit 0
shadow=true port=51170 accepted by: SHADOW listener 127.0.0.1:51170 (remote 127.0.0.1:51171)
container output: nc exit 0

--- a/cmd/crossplane/render/contextfn/listener.go
+++ b/cmd/crossplane/render/contextfn/listener.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"net"
 	"sync"
+	"syscall"
 	"time"
 
 	fnv1 "github.com/crossplane/function-sdk-go/proto/v1"
@@ -63,8 +64,7 @@ func Start(ctx context.Context, log logging.Logger, contextData map[string]any)
 		return nil, errors.Wrap(err, "cannot create capture context function input")
 	}
 
-	var lc net.ListenConfig
-	lis, err := lc.Listen(ctx, "tcp", ":0")
+	lis, err := listen(ctx)
 	if err != nil {
 		return nil, errors.Wrap(err, "cannot create listener for context function")
 	}
@@ -73,7 +73,7 @@ func Start(ctx context.Context, log logging.Logger, contextData map[string]any)
 	fn := newServer(contextData)
 	fnv1.RegisterFunctionRunnerServiceServer(srv, fn)
 
-	addr := lis.Addr().(*net.TCPAddr) //nolint:forcetypeassert // We specified "tcp" above.
+	addr := lis[0].Addr().(*net.TCPAddr) //nolint:forcetypeassert // listen only returns TCP listeners.
 
 	h := &Handle{
 		// Report the target as 127.0.0.1:PORT since the render machinery knows
@@ -85,15 +85,81 @@ func Start(ctx context.Context, log logging.Logger, contextData map[string]any)
 		captureInput: &runtime.RawExtension{Raw: ci},
 	}
 
-	go func() {
-		if err := srv.Serve(lis); err != nil {
-			log.Debug("Context function gRPC server stopped", "error", err)
-		}
-	}()
+	for _, l := range lis {
+		go func() {
+			if err := srv.Serve(l); err != nil {
+				log.Debug("Context function gRPC server stopped", "error", err)
+			}
+		}()
+	}
 
 	return h, nil
 }
 
+// listen returns listeners for a single port P that is reachable on all
+// interfaces (so the render engine container can reach it via
+// host.docker.internal) and whose 127.0.0.1:P address - the target we
+// advertise - is guaranteed to reach this process.
+//
+// On BSD-derived kernels such as macOS's, a dual-stack wildcard listener on
+// [::]:P does not stop another process from listening on 127.0.0.1:P (before or
+// after us), and connections to 127.0.0.1:P go to that more specific listener.
+// We therefore also claim 127.0.0.1:P ourselves. On Linux that bind fails
+// because our wildcard listener already owns 127.0.0.1:P; we confirm that by
+// dialing ourselves. If another process owns 127.0.0.1:P we try another port.
+func listen(ctx context.Context) ([]net.Listener, error) {
+	var lc net.ListenConfig
+	for range 10 {
+		all, err := lc.Listen(ctx, "tcp", ":0")
+		if err != nil {
+			return nil, err
+		}
+		port := all.Addr().(*net.TCPAddr).Port //nolint:forcetypeassert // We specified "tcp" above.
+
+		lo, err := lc.Listen(ctx, "tcp4", fmt.Sprintf("127.0.0.1:%d", port))
+		if err == nil {
+			return []net.Listener{all, lo}, nil
+		}
+		if !errors.Is(err, syscall.EADDRINUSE) {
+			_ = all.Close()
+			return nil, err
+		}
+		if servesLoopback(ctx, all, port) {
+			return []net.Listener{all}, nil
+		}
+		_ = all.Close()
+	}
+	return nil, errors.New("cannot find a port whose loopback address is not held by another process")
+}
+
+// servesLoopback reports whether a connection to 127.0.0.1:port is accepted by
+// lis. It must be called before lis is served.
+func servesLoopback(ctx context.Context, lis net.Listener, port int) bool {
+	ctx, cancel := context.WithTimeout(ctx, time.Second)
+	defer cancel()
+
+	var d net.Dialer
+	c, err := d.DialContext(ctx, "tcp4", fmt.Sprintf("127.0.0.1:%d", port))
+	if err != nil {
+		return false
+	}
+	defer c.Close() //nolint:errcheck // Nothing useful to do.
+
+	tl := lis.(*net.TCPListener) //nolint:forcetypeassert // listen only creates TCP listeners.
+	_ = tl.SetDeadline(time.Now().Add(time.Second))
+	defer tl.SetDeadline(time.Time{}) //nolint:errcheck // Nothing useful to do.
+
+	a, err := tl.Accept()
+	if err != nil {
+		return false
+	}
+	defer a.Close() //nolint:errcheck // Nothing useful to do.
+
+	ra := a.RemoteAddr().(*net.TCPAddr) //nolint:forcetypeassert // Accepted from a TCP listener.
+	la := c.LocalAddr().(*net.TCPAddr)  //nolint:forcetypeassert // Dialed over TCP.
+	return ra.Port == la.Port && ra.IP.Equal(la.IP)
+}
+
 // Stop gracefully stops the function server, which closes its listener. Safe to
 // call multiple times.
 func (h *Handle) Stop() {