tailscale's netcheck has an "incremental" mode where it only probes the 3 fastest regions based on the last netcheck

https://github.com/coder/tailscale/blob/c821c9c9966dd8a58f0fb03aca30743f151e57de/net/netcheck/netcheck.go#L420

If we have more than 3 regions without STUN in addition to at least one region with STUN, then the incremental netcheck could choose the non-STUN regions, and not set the IPv4CanSend boolean true in the netcheck report.

Then, our modified logic to determine whether we should rebind:

https://github.com/coder/tailscale/blob/c821c9c9966dd8a58f0fb03aca30743f151e57de/wgengine/magicsock/magicsock.go#L539

determines that we should rebind because we didn't actually send any STUN probes, but there are STUN regions in the DERPMap.

Yet another case of tailscale.com's assumptions (there is a STUN server in every region) not matching our deployment scenario.