I've followed this thread with interest, as I have asked a similar question of Avaya lately. There are a couple of things that need to be clarified here:
VM Pro is not supported on XP Home, so discussion on that topic is irrelevant.
Don't get confused between the limit of connections on non-server OSs (which are concurrent), and licensed connections to a server OS (which are not concurrent, i.e. if you have 5 client you need 5 CALs, regardless of how many are connected to the server at any one time).
Windows CALs have changed between Windows 2000 and 2003. In Windows 2000, CALs were required when accessing certain services on the server (e.g. file sharing). In 2003, this has changed. In Microsoft's words:
“With Windows Server 2003, CALs are no longer triggered based on the use of certain services but are instead based on access to and/or use of the server software…...Note the following general exception to Windows CAL requirements: Windows CALs are not required when access to the server software is unauthenticated and conducted through the Internet.”
I can't find anything more specific than that, but that paragraph says to me that all IPO applications require CALs if run on a server OS (as they are unauthenticated but connecting over the LAN rather then the internet). This includes VM Pro, as the IPO is the device connecting to the server (so this will require 1 CAL, regardless of the number of VM ports). This is my interpretation of the available info, although I am by no means a Microsoft expert.
I have posed this question to Avaya, the response (from the IPO product management team) is that because Windows CALs are only a legal requirement (the software will still work without the licenses, but will be illegal) Avaya will not document or advise as to whether CALs are required.