If you use QoS 1, PUBLISH packets will be sent to all subscribers before sending out a PUBACK to the sender. So, if QoS 1 is implemented correctly, all the duplicates will arrive before the PUBACK. If not, we have one more bug.