apparently your cluster is a
color FIS? (very nice)
finding an 8e0 dump to compare it to wans't as quick or easy as I had hoped.
I've compared your two reads with an 8e0920930j dump that I found at a german site, and there seems to be information missing from your first read.
The J dump:
-also has [64 03] at E6, so finding the matching 06403 in the cluster dump was sheer coincidence.
-also has the sequence of [10 10] in the same places as the bjorn dumps, so that affirms that 01010 or 04112 aren't valid as the pin.
-has the first nine digits of the vin starting at F7 (incomplete in both bjorn dumps), and then the full vin starting at 158 (incomplete in the second bjorn dump.
unless you have been writing an edited dump back to the cluster, I don't know why it would change on its own. (although I have read other posts about the perils of reading clusters with clone tools)
I don't advocate editing and re-writing the data to the cluster without verifying and understanding whether these cluster dumps are checksummed or not. Everything else about the file visually appears normal.
I don't know how else to direct you Bjorn, I did read somewhere that some of these clusters only contain some data used for calculating the pin, but not the pin itself.
best of luck, let us know what you figure out if you get it sorted.
-Cyril