Gerrit users cannot fetch a visible pending change's ref `refs/changes/06/304506/1`

Our gerrit users, including admins, cannot fetch some refs, for example refs/changes/06/304506/1. The change 304506 is visible to the user. The user can browse the change on gerrit web. The change can also be queried by the user through ssh commands or restapis. In the server repository, git for-each-ref prints the ref refs/changes/06/304506/1. However, in the client repository, git ls-remote cannot print the ref and git fetch origin refs/changes/06/304506/1 fails saying fatal: couldn't find remote ref refs/changes/06/304506/1.

We doubt it's caused by a recent access adjustment, but none of the access changes seems related. As the adjustment is for an important requirment, we cannot simply revert it. Here are the odds that go beyond my knowledge:

1. Even an admin user that is expected to have access to all refs, can only retrieve some of the refs by git fetch or git ls-remote. If a commit is pushed to refs/for/foo and submitted, it can be fetched by git fetch origin foo.
2. In the access configuration of all levels, there are no ref patterns about refs/changes or refs with numbers. The possible ref pattern is refs/*. But to my knowledge, it should affect all refs.
3. We compare the sorted refs produced by git for-each-ref refs/changes | sort -u in a server repository, with the sorted refs produced by git ls-remote | grep refs/changes | sort -u in a client repository. The refs are naturally grouped by the 3rd segment(/06/, which indicates the change number's last 2 digits are 06). In the same group, it seems only the refs whose 4th segment(304506) is bigger than a certain number can be fetched. Due to the limited samples, we cannot find out the specific boundary number. It's around 305xxx. And there are a few exceptions which are smaller than the boundary but can be fetched. We doubt it's not about which is bigger or smaller but if it matches some pattern.

So far we have tried:

1. Expicility grant the access read refs/changes/* or read refs/changes/06/304506/1 with and without exclusive to the admin user.
2. Run ssh -p 29418 $admin@$gerrithost gerrit index changes 304506.
3. Clone with --mirror.

But none worked. Thanks for any suggestion and help.