Interestingly enough, but this wasn't caught in tests. I wonder if it's possible to write a test case for it.
Roman, -ast-dump shows the correct result, because the correct address space is encoded in qualifiers and is passed to Context.getAddrSpaceQualType(...) later in this function. This is why this bug is not observable from the AST. But if you try accessing real Attr* from TypeSourceInfo, you'll see this mismatch.