Regression in the IIOP stack that produces either IOE or JVM crash

This is clearly a regression in JDK 6 u12 b01 (we've run with every single build of u10 and u11 without any issue).
I've a set of 5 JMX QE tests that turned red; their respective failures, detailed below, go from an IOE to a JVM crash (always client side).
Each test is run between two JVM, the first runs a JMX connector server, the second runs one or more JMX connector client(s). When the communication is based over RMI/JRMP, all goes fine.

stress_006: that test mixes requests and notifications and uses two JMX connectors.
The JVM crashes client side (hs_err_pid12053.log attached).

stress_010: that test mixes requests and notifications, uses two JMX connectors.
The JVM crashed client side, no log file nor core file nor stack.

stress_013: that test mixes requests and notifications, uses two JMX connectors with security enabled.
It fails client side with an IOE as below but on another machine the JVM crashed client side (hs_err_pid29613.log attached):
java.rmi.MarshalException: CORBA COMM_FAILURE 1398079696 Maybe; nested exception is:
org.omg.CORBA.COMM_FAILURE: vmcid: SUN minor code: 208 completed: Maybe
at com.sun.corba.se.impl.javax.rmi.CORBA.Util.mapSystemException(Util.java:189)
at javax.rmi.CORBA.Util.mapSystemException(Util.java:67)
at org.omg.stub.javax.management.remote.rmi._RMIConnection_Stub.setAttribute(Unknown Source)
at javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.setAttribute(RMIConnector.java:936)
at javasoft.sqe.jmx.test.stress_reliability.ConnectorThread.sendGetSetInvokeQueries(JMXClient.java:1376)
at javasoft.sqe.jmx.test.stress_reliability.ConnectorThread.run(JMXClient.java:1174)
Caused by: org.omg.CORBA.COMM_FAILURE: vmcid: SUN minor code: 208 completed: Maybe
at com.sun.corba.se.impl.logging.ORBUtilSystemException.connectionAbort(ORBUtilSystemException.java:2400)
at com.sun.corba.se.impl.logging.ORBUtilSystemException.connectionAbort(ORBUtilSystemException.java:2418)
at com.sun.corba.se.impl.transport.SocketOrChannelConnectionImpl.readBits(SocketOrChannelConnectionImpl.java:354)
at com.sun.corba.se.impl.transport.SocketOrChannelConnectionImpl.handleEvent(SocketOrChannelConnectionImpl.java:1122)
at com.sun.corba.se.impl.transport.SelectorImpl.run(SelectorImpl.java:282)
Caused by: org.omg.CORBA.COMM_FAILURE: vmcid: SUN minor code: 211 completed: No
at com.sun.corba.se.impl.logging.ORBUtilSystemException.ioexceptionWhenReadingConnection(ORBUtilSystemException.java:2484)
at com.sun.corba.se.impl.logging.ORBUtilSystemException.ioexceptionWhenReadingConnection(ORBUtilSystemException.java:2502)
at com.sun.corba.se.impl.protocol.giopmsgheaders.MessageBase.readGIOPHeader(MessageBase.java:116)
at com.sun.corba.se.impl.transport.CorbaContactInfoBase.createMessageMediator(CorbaContactInfoBase.java:150)
at com.sun.corba.se.impl.transport.SocketOrChannelConnectionImpl.readBits(SocketOrChannelConnectionImpl.java:314)
... 2 more
Caused by: java.io.IOException: End-of-stream
at com.sun.corba.se.impl.transport.SocketOrChannelConnectionImpl.readFully(SocketOrChannelConnectionImpl.java:602)
at com.sun.corba.se.impl.transport.SocketOrChannelConnectionImpl.read(SocketOrChannelConnectionImpl.java:521)
at com.sun.corba.se.impl.protocol.giopmsgheaders.MessageBase.readGIOPHeader(MessageBase.java:112)
... 4 more

stress_015: that test does JMX requests only, with one JMX connector only.
It fails the same way as stress_013, see above.

stress_018: that test does JMX notifications only, with one JMX connector only.
It fails the same way as stress_013, see above.
On another machine the JVM crashed client side (core attached).