Another bug in unwrapped property handling (in both BeanDeserializer.deserializeWithUnwrapped() methods) is that all the properties stashed in the TokenBuffer are also sent to the any setter, regardless of whether they'll later be consumed in processUnwrapped().

Note for anyone else encountering this: as a hacky partial work-around for the first bug, this means you may be able to add a @JsonAnySetter method to your class (or modify the existing one, if you already have one) to throw an UnrecognizedPropertyException if the property name isn't in a list of the unwrapped subproperty names. But of course then that list will have to be maintained in sync with your model. It also won't work if the properties on the unwrapped property value can't all be deserialized with the same binding type (e.g., Object or JsonNode, neither of which seems to work for array- or collection-valued properties). And it causes a potentially non-trivial amount of extra work to be performed, to deserialize those property values for the any setter as well as in processUnwrapped().

I think this may dup of #650?

Yes, unwrapped handling has no way of determining if something is or is not unknown, because deserializers are not required to indicate if such set is limited or not: for example, use of @JsonAnySetter allows indefinite set of properties to be accepted. Similarly, Maps can contain any and all Object properties. There have been additions to BeanDeserializer that may allow some level of additional introspection that perhaps could be used to improve handling.

Whether this behavior may or may not be changed is not clear at this point; from internal perspective this may be a hard limitation.

Yes, I looked for an existing issue and didn't find that one, but it is a dup.

Quite understandable, there are a few issues and original is quite old.
Feel free to add notes on original ones if details are missing.