It turns out that the trigger in #3969 does indeed contain a bug. Namely that a request, that is aborted during the request lifecycle, can cause a timeout, and log a 503 response even though nothing was ever sent down the wire.

Further investigation found that this was caused by the stream draining code in the default handler, which never completes if the stream is aborted. This in turn means that the _lifecycle() call in request._execute() never returns, and thus skips the call to _reply() that would clear the timeout timer.

The other part of the patch relates to the clientError handling. Here I found a case where a client can receive a 400 Bad Request response, while the server logs it as a regular response.
This is because, contrary to the node docs, the clientError event can be triggered while processing an request on the socket, which hapi doesn't expect.

I have updated the handler, to send a 400 Bad Request response through any outstanding requests instead of writing it directly to the socket, which seems to fix the issue.