This bug affects also pre-4.x versions !
We got it with 3.6.10... where a @OneToMany was managed by a Set<> on a root class of a hierarchy, the cached instance was of the root class (the one declared in the generic) instead of the actual instance class, and the leaf class instances are chained together by self-link.
We were able to circumvent the problem by using a List<> instead of the Set<>, removing the dependency on the "randomness" of the hash code used in the under laying Set implementation: List<> iteration respecting the persistence order, but the patch is the actual solution.