In LeftInputAdapterNode a modifyByPass happens, for a sink that has not been reached before. So it thinks it's new, and thus propagates as an insert

The real bug comes in doInsertObject method. It creates a child LT here, even though once it enters doInsertSegmentMemory the mask intersect fails. This leaves a child LT, that is not propagated. Next time update is called, as the LT is there it thinks it's a modify and propagates as a modify - but it never reached the beta node or the LeftMemory, and thus the memory corruption.

I managed to isolate the problem with the failing test case I am pasting below. Note that if you remove the @PropertyReactive annotation from the Hero class the test becomes green.

    @Test
    public void testWumpus() {
        String drl = "import org.drools.compiler.integrationtests.Misc2Test.Hero;\n" +
                     "import org.drools.compiler.integrationtests.Misc2Test.StepForwardCommand;\n" +
                     "import org.drools.compiler.integrationtests.Misc2Test.ChangeDirectionCommand;\n" +
                     "\n" +
                     "rule RotateLeft when\n" +
                     "    $h  : Hero( goingRight == true )\n" +
                     "    $dc : ChangeDirectionCommand()\n" +
                     "then\n" +
                     "    retract ( $dc );   \n" +
                     "    modify ( $h ) { setGoingRight( false ) };\n" +
                     "end\n" +
                     "\n" +
                     "rule RotateRight when\n" +
                     "    $h  : Hero( goingRight == false )\n" +
                     "    $dc : ChangeDirectionCommand()\n" +
                     "then\n" +
                     "    retract ( $dc );   \n" +
                     "    modify ( $h ) { setGoingRight( true ) };\n" +
                     "end\n" +
                     "\n" +
                     "rule StepLeft when\n" +
                     "    $h  : Hero( goingRight == false )\n" +
                     "    $sc : StepForwardCommand()\n" +
                     "then\n" +
                     "    retract ( $sc );   \n" +
                     "    modify ( $h ) { setPos( $h.getPos()-1 ) };\n" +
                     "end\n" +
                     "\n" +
                     "rule StepRight when\n" +
                     "    $h  : Hero( goingRight == true )\n" +
                     "    $sc : StepForwardCommand()\n" +
                     "then\n" +
                     "    retract ( $sc );\n" +
                     "    modify ( $h ) { setPos( $h.getPos()+1 ) };\n" +
                     "end\n";

        KnowledgeBuilderConfiguration kbConf = KnowledgeBuilderFactory.newKnowledgeBuilderConfiguration();
        KnowledgeBase kbase = loadKnowledgeBaseFromString( kbConf, drl );

        StatefulKnowledgeSession ksession = kbase.newStatefulKnowledgeSession();

        Hero hero = new Hero(1);
        ksession.insert(hero);
        ksession.fireAllRules();

        ksession.insert(new StepForwardCommand());
        ksession.fireAllRules();
        ksession.insert(new StepForwardCommand());
        ksession.fireAllRules();
        assertEquals(3, hero.getPos());

        ksession.insert(new ChangeDirectionCommand());
        ksession.fireAllRules();
        ksession.insert(new StepForwardCommand());
        ksession.fireAllRules();
        assertEquals(2, hero.getPos());
    }

    @PropertyReactive
    public static class Hero {
        private int pos = 1;
        private boolean goingRight = true;

        public Hero(int pos) {
            this.pos = pos;
        }

        public int getPos() {
            return pos;
        }

        public void setPos(int pos) {
            this.pos = pos;
        }

        public boolean isGoingRight() {
            return goingRight;
        }

        public void setGoingRight(boolean goingRight) {
            this.goingRight = goingRight;
        }
    }

    public static class ChangeDirectionCommand { }
    public static class StepForwardCommand { }