There are two known cases where protected-accessibility is handled incorrectly:
package p1;
class A {
protected int f;
}
package p2;
class B extends p1.A{
void foo() { new p1.A().f = 3; } // invalid access!
}
Second case, with inner classes:
package p1;
public class A {
protected class I{}
}
package p2;
class B extends p1.A {
void foo() {
new I(); // not visible!!
}
}
Note: The latter is according to JLS, §8.8.9, third edition.