When rpcbind is started using the -h flag, it will bind to the specified IP address *only* for the static port 111. Any UDP-ports it then opens are bound to INADDR_ANY, which is either not the desired behavior or is something that should be clearly documented.
See #117711