In the following cases, the injected-class-name is treated as a template-name of the class template itself:
- it is followed by <
 - it is used as a template argument that corresponds to a template template parameter
 - it is the final identifier in the elaborated class specifier of a friend class template declaration.
 
So I tried to examine all 3 cases (additionally in context of base ambiguity though I think it shouldn't matter here).
The first case seems simple.
The question is - why don't commented out examples work? They don't on both GCC & Clang so I don't think it's an implementation issue
template <template <class> class> struct A;
template <class T> struct Base {};
template <class T> struct Derived: Base<int>, Base<char>
{
    // #1
    typename Derived::Base<double> d;
    
    // #2
    
    // using a = A<Base>;
    using a = A<Derived::template Base>;
    // #3
    template<class U1>
    friend struct Base;
    // template<class U>
    // friend struct Derived::template Base;
};
Are the rules above only for template itself, not for bases? If so, what are rules for bases, especially for the last 2 of the cases?