The bug seems to be that [basic.lookup] p2 restricts itself to "unqualified names". That's also wrong for other uses of the phrase; e.g. [basic.lookup.classref] 6.4.5p6:

If the nested-name-specifier contains a simple-template-id (12.2), the names in its _template-argument_s are looked up in the context in which the entire postfix-expression occurs.

In fact, 6.4.5 [basic.lookup.classref] and 10.7 [class.member.lookup] conspicuously ignore each other, although they mostly talk about the same thing.

I think the issue is a misuse of "qualified name" by [over.call.func]. The term "name" is defined as not including the ::-es by [basic]p9 and p4, and that matches its use in the remainder of [basic]. From what I can see, in [basic] a "qualified name" is simply a name with a nested name specifier prepended. It's not the entire construct including the nested name specifier, as far as I can tell.

For example: [basic.lookup.qual]p4: "A name prefixed by the unary scope operator :: ([expr.prim.id.qual]) is looked up in global scope" - this means that in ::a::b, the a is looked up in global scope. But if you would consider both a and a::b as names, the rule becomes ambiguous.