Some time ago I was at a talk about verifying different MQTT brokers so they fulfill the spec. They presented several inconsistencies they found (in OSS brokers) and submitted fixes for.

I looked up if there's some info online and found that paper (unfortunately paywalled): https://graz.pure.elsevier.com/en/publications/learning-base...