I have forked cxf and created a branch "feature/dispatcher-policy" where the systests/jaxws DispatcherTest class has been retrofitted to test POLICY_OVERRIDE with StAX.
The branch should NOT be merged to master as I have disabled all the other tests in the DispatcherTest class and I have added ws-security policy wsdl as well.
Anyhow, the branch reproduce the error I see in my project.
PolicyEnforcer rejects the server reply at the client side.
The following test case has been enhanced with ws-security policy:
The error can be reproduced by running that test case.