Following scenario

• user profile field created
• defaullt value for user profile field specified
• user profile field locked
• user profile field visible to user

With these properties set, when a user edits the profile following happens

• instead of displaying the actual value of the user profile field, the default value ist displayed in the form
• when user saves the profile, the default value replaces the actual value of the user profile field

So these are actually two bugs, but the second bug could be a security issue, because the Capabilities of the user aren't respected (prevent from updating the user profile field, even if it's locked)

This bug is reproducable (tested on two different systems)

The issue could be there (/user/profile/field/lib.php)

function edit_field_set_locked(&$mform) {
if ($this->is_locked() and !has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM)))

{ $mform->hardFreeze($this->inputname); $mform->setConstant($this->inputname, $this->data); }

}

and there (/user/profile/field/lib.php)

function edit_field_set_default(&$mform) {
if (!empty($default))

{ $mform->setDefault($this->inputname, $this->field->defaultdata); }

}