BootstrapBundlesIntegration has this:

URL manifestURL = module.getClassLoader().getResource(JarFile.MANIFEST_NAME); // PROBLEM
if (manifestURL != null) {
    InputStream input = manifestURL.openStream();
    try {
        Manifest manifest = new Manifest(input);
        if (OSGiManifestBuilder.isValidBundleManifest(manifest)) {
            return OSGiMetaDataBuilder.load(manifest);
        }
    } finally {
        input.close();
    }
}

The line marked // PROBLEM is problematic, since a module may have more than one resource associated with the given path, and that call will return the URL for the first one found, and not necessarily a URL for a resource located inside the intended module. For example, in testing a patch for a different issue I found that the same call for module "org.jboss.netty" could return a URL pointing to:

org/jboss/logging/main/jboss-logging-3.1.2.GA.jar
javax/servlet/api/main/jboss-servlet-api_3.0_spec-1.0.2.Final.jar
org/jboss/netty/main/netty-3.4.5.Final.jar

The first two modules are listed as dependencies of org.jboss.netty.

A module could also include more than one jar, again leading to the possibility of multiple URLs with only one being relevant. But I'm not sure what the intended behavior is in that case.

Calling getResources(JarFile.MANIFEST_NAME) instead of getResource and then iterating through the enumeration and checking to see if the URL is associated with the target module would be a possible fix.