After T275394, one problem remains with IP addresses in the UsersMultiselectWidget: the JS widget allows the same address to be entered more than once, in different formats (e.g. ::1 and 0:0:0:0:0:0:0:1). If there is a limit set for the number of items that can be entered, both will count towards this limit.

They are de-duplicated in the PHP, however, so anything handling the widget's input will receive only unique IP addresses. Also the PHP version of the widget will respect the limits correctly.

From gerrit:

You would probably need to poke around the mw.widgets.UsersMultiselectWidget.prototype.updateMenuItems, which is where you can see the de-duping happening for the usernames as part of the API call, and add some kind of normalizing function there so that you have that IP to check against.