Well, it’s complicated, but again this is a bug in this server. It’s indicating that the ByteString containing the encoded DataChangeNotification is null (length -1, FF FF FF FF in the following screenshot), which causes our decoder to move onto the next field and start decoding bogus data because the ByteString is actually present in the stream. Wireshark can see it because the way it’s written it ignores this length for built-in OPC UA types.
You’ll have to contact Siemens and see if they have a fix or upgrade available.