There is a race in Socket when BeginSendTo is used on an unbound socket. You can see code for setting _rightEndPoint:

https://github.com/dotnet/corefx/blob/da1f8120aeec867bbd81829358ed348d323b1d14/src/System.Net.Sockets/src/System/Net/Sockets/Socket.cs#L2700-L2737

SocketTaskExtensions.SendToAsync wraps this and so is also affected.

_rightEndPoint is also used in BeginReceiveFrom in a way that could cause a parameter check to be "skipped" if BeginSendTo resets it to null.