Program: 170418
Project: 170418
Buggy source:
private void onSecureMessage(ChannelHandlerContext ctx,ByteBuf buffer,List<Object> out) throws UaException {
  buffer.skipBytes(3);
  char chunkType=(char)buffer.readByte();
  if (chunkType == 'A') {
    chunkBuffers.forEach(ByteBuf::release);
    chunkBuffers.clear();
  }
 else {
    buffer.skipBytes(4);
    long secureChannelId=buffer.readUnsignedInt();
    if (secureChannelId != secureChannel.getChannelId()) {
      throw new UaException(StatusCodes.Bad_SecureChannelIdInvalid,"String_Node_Str" + secureChannelId);
    }
    SymmetricSecurityHeader securityHeader=SymmetricSecurityHeader.decode(buffer);
    ChannelSecurity channelSecurity=secureChannel.getChannelSecurity();
    long currentTokenId=channelSecurity.getCurrentToken().getTokenId();
    if (securityHeader.getTokenId() != currentTokenId) {
      long previousTokenId=channelSecurity.getPreviousToken().map(ChannelSecurityToken::getTokenId).orElse(-1L);
      if (securityHeader.getTokenId() != previousTokenId) {
        throw new UaException(StatusCodes.Bad_SecureChannelTokenUnknown,"String_Node_Str" + securityHeader.getTokenId());
      }
    }
    chunkBuffers.add(buffer.readerIndex(0).retain());
    if (chunkBuffers.size() > maxChunkCount) {
      throw new UaException(StatusCodes.Bad_TcpMessageTooLarge,String.format("String_Node_Str",maxChunkCount));
    }
    if (chunkType == 'F') {
      final List<ByteBuf> buffersToDecode=chunkBuffers;
      chunkBuffers=Lists.newArrayListWithCapacity(maxChunkCount);
      serializationQueue.decode((binaryDecoder,chunkDecoder) -> {
        try {
          ByteBuf messageBuffer=chunkDecoder.decodeSymmetric(secureChannel,MessageType.SecureMessage,buffersToDecode);
          binaryDecoder.setBuffer(messageBuffer);
          UaResponseMessage response=binaryDecoder.decodeMessage(null);
          if (response instanceof ServiceFault) {
            client.getExecutorService().execute(() -> client.receiveServiceFault((ServiceFault)response));
          }
 else {
            client.getExecutorService().execute(() -> client.receiveResponse(response));
          }
          messageBuffer.release();
          buffersToDecode.clear();
        }
 catch (        UaException e) {
          logger.error("String_Node_Str",e.getMessage(),e);
          ctx.close();
        }
      }
);
    }
  }
}

Fixed version (ground truth):
private void onSecureMessage(ChannelHandlerContext ctx,ByteBuf buffer,List<Object> out) throws UaException {
  buffer.skipBytes(3);
  char chunkType=(char)buffer.readByte();
  if (chunkType == 'A') {
    chunkBuffers.forEach(ByteBuf::release);
    chunkBuffers.clear();
  }
 else {
    buffer.skipBytes(4);
    long secureChannelId=buffer.readUnsignedInt();
    if (secureChannelId != secureChannel.getChannelId()) {
      throw new UaException(StatusCodes.Bad_SecureChannelIdInvalid,"String_Node_Str" + secureChannelId);
    }
    SymmetricSecurityHeader securityHeader=SymmetricSecurityHeader.decode(buffer);
    ChannelSecurity channelSecurity=secureChannel.getChannelSecurity();
    long currentTokenId=channelSecurity.getCurrentToken().getTokenId();
    if (securityHeader.getTokenId() != currentTokenId) {
      long previousTokenId=channelSecurity.getPreviousToken().map(ChannelSecurityToken::getTokenId).orElse(-1L);
      if (securityHeader.getTokenId() != previousTokenId) {
        throw new UaException(StatusCodes.Bad_SecureChannelTokenUnknown,"String_Node_Str" + securityHeader.getTokenId());
      }
    }
    chunkBuffers.add(buffer.readerIndex(0).retain());
    if (chunkBuffers.size() > maxChunkCount) {
      throw new UaException(StatusCodes.Bad_TcpMessageTooLarge,String.format("String_Node_Str",maxChunkCount));
    }
    if (chunkType == 'F') {
      final List<ByteBuf> buffersToDecode=chunkBuffers;
      chunkBuffers=Lists.newArrayListWithCapacity(maxChunkCount);
      serializationQueue.decode((binaryDecoder,chunkDecoder) -> {
        try {
          ByteBuf messageBuffer=chunkDecoder.decodeSymmetric(secureChannel,MessageType.SecureMessage,buffersToDecode);
          binaryDecoder.setBuffer(messageBuffer);
          UaResponseMessage response=binaryDecoder.decodeMessage(null);
          if (response instanceof ServiceFault) {
            client.getExecutorService().execute(() -> client.receiveServiceFault((ServiceFault)response));
          }
 else {
            client.getExecutorService().execute(() -> client.receiveServiceResponse(response));
          }
          messageBuffer.release();
          buffersToDecode.clear();
        }
 catch (        UaException e) {
          logger.error("String_Node_Str",e.getMessage(),e);
          ctx.close();
        }
      }
);
    }
  }
}