One thing I found after analyzing the sqlnet trace file is when this ORA-12539 happens, the pattern is:

(280) [000007 13-APR-2005 07:26:17:803] nsrdr: recving a packet
(280) [000007 13-APR-2005 07:26:17:803] nsprecv: reading from transport...
(280) [000007 13-APR-2005 07:26:17:803] nttrd: entry
(280) [000007 13-APR-2005 07:26:17:803] nttrd: socket 772 had bytes read=530
(280) [000007 13-APR-2005 07:26:17:803] nttrd: exit
(280) [000007 13-APR-2005 07:26:17:803] nsprecv: 530 bytes from transport
(280) [000007 13-APR-2005 07:26:17:803] nsprecv: tlen=530, plen=530, type=6
(280) [000007 13-APR-2005 07:26:17:803] nsrdr: got NSPTDA packet
(280) [000007 13-APR-2005 07:26:17:803] nsrdr: NSPTDA flags: 0x40
(280) [000007 13-APR-2005 07:26:17:803] nsdo: *what=1, *bl=520
(280) [000007 13-APR-2005 07:26:17:803] nsdo: 520 bytes from NS buffer
(280) [000007 13-APR-2005 07:26:17:803] nscon: got 520 bytes connect data
(280) [000007 13-APR-2005 07:26:17:803] nsmfr: 520 bytes at 0x165ac18
(280) [000007 13-APR-2005 07:26:17:803] nscon: connect data overflow
(280) [000007 13-APR-2005 07:26:17:803] nserror: nsres: id=0, op=77, ns=12539, ns2=0; nt[0]=0, nt[1]=0, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0
(280) [000007 13-APR-2005 07:26:17:803] snsbitts_ts: acquired the bit
(280) [000007 13-APR-2005 07:26:17:803] nsdo: nsctxrnk=0
(280) [000007 13-APR-2005 07:26:17:803] nscall: unexpected response
(280) [000007 13-APR-2005 07:26:17:803] nstimarmed: no timer allocated
(280) [000007 13-APR-2005 07:26:17:803] snsbitts_ts: acquired the bit
(280) [000007 13-APR-2005 07:26:17:803] nsdo: cid=0, opcode=98, *bl=0, *what=0, uflgs=0x440, cflgs=0x2
(280) [000007 13-APR-2005 07:26:17:803] snsbitts_ts: acquired the bit
(280) [000007 13-APR-2005 07:26:17:803] nsdo: rank=64, nsctxrnk=0
(280) [000007 13-APR-2005 07:26:17:803] nsdo: nsctx: state=6, flg=0x804201, mvd=0
(280) [000007 13-APR-2005 07:26:17:803] snsbitts_ts: acquired the bit
(280) [000007 13-APR-2005 07:26:17:803] nsdo: nsctxrnk=0
(280) [000007 13-APR-2005 07:26:17:803] nsclose: closing transport
(280) [000007 13-APR-2005 07:26:17:803] nttdisc: entry
(280) [000007 13-APR-2005 07:26:17:803] nttdisc: Closed socket 772
(280) [000007 13-APR-2005 07:26:17:803] nttdisc: exit

It seems that Net8 get 530 bytes from transport but the NS buffer is only 520 bytes, it this the reason why? In another case I found Net8 get 544 bytes from transport but the NS buffer is only 534 bytes.