SimpleAttributeOperand for condtionId generated with BrowsePath of arraySize -1

This issue was reported by a user trying to use Qt OPC UA as a client to connect to a SIEMENS OPC UA server.

What the user wants to do :

• Using Qt 6.8.2.
• The user wants to let the application send CreateMonitoredItemRequest to the server.
• The CreateMonitoredItemRequest is with an Eventfilter which includes a conditionId as an element. 
• The conditionId shall be determined with a SimpleAttributeOperand (typeId = NodeId, browsePath[] = empty, attributeId = NodeId attribute). 
  (see https://support.industry.siemens.com/cs/mdm/59192925?c=161193123211&dl=no&lc=en-US )

Actutal behavior :
The user says the response to Qt OPC UA client is BadNodeIdUnknown, while UaExpert can read the conditionID without any issues. And he considers the difference below between UaExpert and Qt OPC UA can be the cause:

1) With UaExpert from United Automation sends it as expected, i.e. the SimplaAttributeOperand for condtionId was generated with BrowsePath of arraySize 0.
See packet No.9388 in uaexpert_2.pcapng and qtopcua_2.png.

2) With a Qt OPC UA client application, the SimplaAttributeOperand for condtionId was generated with BrowsePath of arraySize -1 (0xffff).
See packet No. 410 in opcua_issue_2.pcapng and uaexpert_2.png.

I do not have a SIEMENS OPC UA server, but I reproduced the client's behavior with the waterpump/simulationserver example application.
The Qt OPC UA client I used is attached.