I am considering a case say where we have 10 replicas i.e. 3f+1=10 meaning we can have 3 faulty replicas. Now, assume a scenario where primary is faulty and collude with other two faulty replicas and the remaining non-faulty replicas are in group of 4(G1)and 3(G2).
Now, the primary try to cheat by proposing a client request differently to each non-faulty group say 0 to G1 and 1 to G2. In case of nodes in G1 the quorum 2f+1 can be reached 4(G1)+3(faulty) and thus can commit locally whereas it can’t happen for G2 as they have 3(G2)+3(faulty) i.e only 2f. Therefore, I am assuming G2 replicas will time-out and will initiate view-change process. But as per my understanding view-change will happen only when the new primary receives 2f+1(including self) view-change messages. But in this scenario the faulty might not send view-change which leave us with only G2(3) view change messages and G1 never ask for view change as they are already in quorum. This doesn’t satisfy the safety property. So, how actually PBFT solves this kind of situation?