It has been reported that c:forEach tag with PSS enabled doesn't work well, but if PSS is disabled it works again.
This problem has been known for a long time, but it was considered a flaw in c:forEach tag, and there are know fixes for it:
1. Set javax.faces.PARTIAL_STATE_SAVING to false.
2. Add the page in javax.faces.FULL_STATE_SAVING_VIEW_IDS (disable PSS
on the related page only).
3. Set org.apache.myfaces.REFRESH_TRANSIENT_BUILD_ON_PSS_PRESERVE_STATE to true.
In JSF 2.2 we fixed that tag from root, but it seems possible to add a small workaround over the state saving algorithm to fix at least the duplicate id exception. It is not perfect, but it seems enough in some cases, and the tag will look "less broken". The idea is detect the duplicate when the component is added to the tree and remove the invalid component and replace it with the restored one.