MC-136995Entity/Item Duplication Exploit
Exact details are scarce, but there has been multiple reports that users with hack clients are able to duplicate entities, namely donkeys, to duplicate items.
I have been sent the following description: 
The general gist is that the hack clients use speed hacks while riding a donkey, and are able to run faster than the server can load chunks in the chunk map.
It appears that player position does not stay in sync with the vehicles position, resulting in the chunk map using a different position than the vehicle / client.
This results in letting the player get the entity to the edge of the view distance, and to move into an unloaded chunk.
Where things get tricky is, based on the reports, the chunk appears to 'flash'. I believe this is the chunk loading and unloading in a cycle.
If the entity is moved into the chunk, and then saved, here lies the problem....
The Entity save code checks if the Entity is a passenger, but it does not check if the Entity is a vehicle of a player.
Since Vehicles are saved into a players NBT directly, they should not be saved if they are being driven by a player.
This results in the entity moving into the chunk, the chunk unloading (because according to the chunk map, this chunk is not needed! its out of the view distance of every player)
However... the player is still 3+ chunks back away from this location.
Then that player logs out, while still riding the donkey, and the donkey saves with the players NBT, in a completely different chunk.
Now player B goes to the first incorrectly saved donkeys location, loads the chunk, and now we have a donkey that can be accessed.
Player B logs out or kills the donkey, freeing up the UUID.
Player A logs back in, still with the same donkey, all with the same original items.
The combination of the 3 following changes resolves the issue.
Ensures that anytime a player or vehicle moves, their chunk registration is updated immediately. Thus guaranteeing they are correctly registered.
In this scenario, the player would remain in the same chunk as the donkey, and never result in being saved to 2 different chunks. If the player logs out, the chunk would be resaved without the donkey in it.
This also ensures the chunk map stays correctly synced. Using a base speed 4 donkey, I was unable to run into an unloaded chunk with the applied patches, where as I was able to consistently before.
I believe there is 2 angles to fix here
1) Entities shouldn't save if they are currently being controlled by a player - we expect the player data to save it
2) The server should also process chunk registrations immediately, and synchronize player position to the vehicle position, in the same way we are doing on Paper.
