ArduinoJson (AJ) object corrupts other AJ object

So I have a very wierd behavior using two different ArduinoJson objects. I was not able to reproduce it in a small example but could track it down to some extent.

From MQTT I receive a json string payload looking like this:

{"getLog": {"BOOL": false}, "restartESP": {"BOOL": false}, "config": {"M": {"cRI": {"N": "1200000"}, "cST": {"N": "120000"}, "SSID": {"S": "smartabell"}, "cAL": {"BOOL": true}, "PW": {"S": "smartabell"}}}, "OTA": {"S": "99"}, "time": {"S": ""}, "updateConfig": {"BOOL": false}, "MAC": {"S": "84:CC:A8:00:E7:94"}}

I store it in

DynamicJsonDocument mqttJsonDoc(MY_MQTT_MAX_PACKET_SIZE);
deserializeJson(mqttJsonDoc, payload);

for further parsing, which works fine at the beginning. However, when I call this function to ACK the MQTT package (it is called in the same function where mqttJsonDoc is created):

bool ackDDBAction(const char *new_val, const char *ack_pub_topic)
{
	/* JSON settings */
	DynamicJsonDocument ackJsonDoc(MQTT_MAX_ACK_SIZE);
	ackJsonDoc["MAC"] = MAC_str;
	ackJsonDoc["ACK"] = "";
    ackJsonDoc["updateConfig"] = new_val;
	/* Calculate buffer length */
	size_t jsonSize = measureJson(ackJsonDoc) + 1;
	char jsonBuffer[jsonSize];
	/* Serialize json object into a char array */
	serializeJson(ackJsonDoc, jsonBuffer, jsonSize);
	/* Send ack */
	ack_success = client.publish(ack_pub_topic, jsonBuffer);

	return ack_success;
}

Somehow my original json object mqttJsonDoc is corrupted and looks like:

{"getLog":{"BOOL":false},"restartESP":{"BOOL":false},"config":{"M":{"cRI":{"N":"1200000"},"cST":{"N":"120000"},"SSID":{"S":"smartabell"},"cAL":{"BOOL":true},"PW":{"S":"smartabell"}}},"OTA":{"S":"99"},"time":{"S":""},"updateConfig":{"BOOL":false},"MAC":{"S":"84:CC:A8:00:E7:94"}}{"ub{\"MAC\":\"84CCA800E794\",\"ACK\":\"\",\"getLog\":\"0\"}0000":{"\":\"84CCA800E794\",\"ACK\":\"\",\"getLog\":\"0\"}0000":false},"CCA800E794\",\"ACK\":\"\",\"getLog\":\"0\"}0000":{",\"ACK\":\"\",\"getLog\":\"0\"}0000":false},"\":\"\",\"getLog\":\"0\"}0000":{"etLog\":\"0\"}0000":{"Log\":\"0\"}0000":{":\"0\"}0000":"0\"}0000"},"cST":{"N":"120000"},"SSID":{"S":"smartabell"},"cAL":{"BOOL":true},"PW":{"S":"smartabell"}}},"OTA":{"S":"99"},"time":{"S":""},"updateConfig":{"BOOL":false},"MAC":{"S":"84:CC:A8:00:E7:94"}}

The beginning is similar, but in the middle, fragments of the other jsonDocument ackJsonDoc appear. Besides, it is full of escape chars \. After some debugging, I found out that only when the line serializeJson(ackJsonDoc, jsonBuffer, jsonSize); is executed mqttJsonDoc gets corrupted.

I played around with dynamic and static json document but it didnt change the behavior, besides out of curiosity, I created another json object to see if somehow there was a memory overlap.

	DynamicJsonDocument mqttJsonDoc2(MY_MQTT_MAX_PACKET_SIZE);
	deserializeJson(mqttJsonDoc2, payload);

But this additional dynamic json document holding the payload as well, is corrupted when ackDDBAction() is called. Increasing any of the json objects by size did not lead to an improvement as well.

I was looking for known issues and cavities but didnt find anything in the documentation serializeJson() | ArduinoJson 6.

But maybe someone has an idea or faced this issue before - I could do some work arounds but they would be ugly and I would like to understand what is happening here.

That may allocate a buffer larger than allowed on the stack. Can you allocate it dynamically / use serialJson variant that uses dynamic memory.

Worse case,

	size_t jsonSize = measureJson(ackJsonDoc) + 1;
	char* jsonBuffer = new char[jsonSize];
	/* Serialize json object into a char array */
	serializeJson(ackJsonDoc, jsonBuffer, jsonSize);
	/* Send ack */
	ack_success = client.publish(ack_pub_topic, jsonBuffer);
        delete[] jsonBuffer;

So I solved the issue but it has been a while so I try to describe my solution.

I had to change the payload being deserilaized into Json to a const char* type.

/* Casting it to const char is very important since it forces 
	 the arduinoJson object to copy the content instead of using plain
	 pointer to the payload */
	deserializeJson(mqttJsonDoc, (const char *)payload);

According to the ArduinoJson documentation this copies the content, which the payload pointer points to. I am still not completely sure why the function ackDDBAction() or more precisely the serializeJson() function messes up the memory section payload is pointing to but using the const char* casting works.