I have an XBee3 (fw 100A) as a coordinator for my Zigbee network and a couple of xbees as routers in my network (an S2C fw 4061 and another xbee3 fw 100A). When an end device (xiaomi humidity and temperature sensor) joins the network, the coordinator sends an API frame with the device's 16-bit network address. However when I run a network discovery with XCTU on one of the routers, sometimes I can see that the network address for this MAC is different. For some time, the coordinator continues to receive the attribute reports from the device (with the first network address), so the device seems to function with both addresses simultaniously for the router and coordinator, but it stops sending the attribute reports shortly after (however the sensor continues to be visible to the network discovery with the second address).
I think it only happens when the end device joins the network via a router, not via coordinator. If XCTU shows the device to be connected to both router and coordinator, it shows the second address in the child table (or whatever it shows on mouse hover) for both.
I've just reproduced the same with 1008 firmware as well. Looks like this happens when a device rejoins the network it's already been before. The API use old 16-bit network addresses, effectively preventing the software to bind.