The ZIP contains small patches for eight files in org.apache.xerces.jaxp.validation to implement feature propagation from SchemaFactorys. It also includes a test case.
Thanks Peter. I've committed your patches to SVN with a few modifications. The secure processing feature was not being read from the XSGrammarPoolContainer in the constructor of XMLSchemaValidatorComponentManager. I fixed that and added a test to verify that it works.