"I'd bet this same generator is used in every version since Windows got networking, about 3.1."

Since Win3.1 (and WFW3.11) didn't include an MS written Winsock stack it won't have had this bug. After all no need for crypto functions for SSL if you can't connect to the internet. (Yes, DOS and Win3.1 could connect to the net but you needed a 3rd party Winsock implementation, they couldn't out of the box.)

The first version of Windows to include Winsock was Win95. Fairly good chance this bug has been around since then but my guess is it's part of Winsock 2 which makes it a little later (circa 1998).