In 12.2.4.35 "Attribute name state",
the final paragraph says:
    When the user agent leaves the attribute name state (and before emitting
    the tag token, if appropriate), the complete attribute's name must be
    compared to the other attributes on the same token; if there is already an
    attribute on the token with the exact same name, then this is a parse error
    and the new attribute must be dropped, along with the value that gets
    associated with it (if any).

I realize that this is the earliest point at which to detect this error, and
also the most convenient point at which to say how it's handled. The problem
is that, at this point, a user agent can't fully handle the error, because
the value to be dropped (if any) hasn't been collected yet.

Presumably, the user agent, if it doesn't abort processing, must continue to
run the tokenizer through its states, which will generally append characters
to "the current attribute's value", where "the current attribute" must be
interpreted as referring to the attribute that's (supposedly) already been
dropped.

To clarify things, perhaps change:
    the new attribute must be dropped, along with the value that gets
    associated with it (if any)
to:
    the new attribute must be dropped as soon as its value is complete
or:
    ... as soon as characters can no longer be appended to its value

(Of course, you could identify the points in the state machine where this
occurs, but there's rather a lot of them. You could reduce them drastically
by introducing an "after attribute value" state and redirecting most
attribute-ending transitions through it. [In fact, "after attribute value (quoted) state" could do the job just by deleting "(quoted)".] Then you could
say, okay *this* state is where you drop a same-name attribute. But I suspect
that's more change than this issue is worth.)