DHCP Pools on Ubuntu DHCP server not working properly

Mac addresses ending with "55:a3" and "56:2a" are also ending up in last pool

123    match if binary-to-ascii(16,8,":",substring(hardware, 5, 6)) = "55:a3";                                                                                                                                                                
124 }                                                                                                                                                                                                                                         
125                                                                                                                                                                                                                                           
126 class "esx67" {                                                                                                                                                                                                                           
127    match if binary-to-ascii(16,8,":",substring(hardware, 5, 6)) = "56:2a";                                                                                                                                                                
128 }                                                                                                                                                                                                                                         
129                                                                                                                                                                                                                                           
130 shared-network 20-30 {                                                                                                                                                                                                                    
131    subnet 20.30.0.0 netmask 255.255.0.0 {                                                                                                                                                                                                 
132       option domain-name "nsbucqesystem.test";                                                                                                                                                                                            
133       option domain-name-servers 20.30.0.1;                                                                                                                                                                                               
134       option routers 20.30.0.1;                                                                                                                                                                                                           
135       default-lease-time 2592000;                                                                                                                                                                                                         
136       max-lease-time 2592000;                                                                                                                                                                                                             
137       ping-check true;                                                                                                                                                                                                                    
138    }                                                                                                                                                                                                                                      
139    pool {                                                                                                                                                                                                                                 
140       allow members of "esx65";                                                                                                                                                                                                           
141       range 20.30.1.1 20.30.1.254;                                                                                                                                                                                                        
142    }                                                                                                                                                                                                                                      
143    pool {                                                                                                                                                                                                                                 
144       allow members of "esx67";                                                                                                                                                                                                           
145       range 20.30.2.1 20.30.2.254;                                                                                                                                                                                                        
146    }                                                                                                                                                                                                                                      
147    pool {                                                                                                                                                                                                                                 
148       deny members of "esx67";                                                                                                                                                                                                            
149       deny members of "esx65";                                                                                                                                                                                                            
150       range 20.30.3.1 20.30.254.254;                                                                                                                                                                                                      
151    }                                                                                                                                                                                                                                      
152 }   

Can anyone point error in that configration

The problem lies in the use of the hardware filter.

The documentation states that:

The hardware operator returns a data string whose first element is the type of network interface indicated in packet being considered, and whose subsequent elements are client's link-layer address. If there is no packet, or if the RFC2131 hlen field is invalid, then the result is null. Hardware types include ethernet (1), token-ring (6), and fddi (8). Hardware types are specified by the IETF, and details on how the type numbers are defined can be found in RFC2131 (in the ISC DHCP distribution, this is included in the doc/ subdirectory).

In other words, hardware, 5, 6 does not return the 5th and 6th octet of the MAC address, as you may expect, but the 4th and 5th, because the first element will be the type (0x01, because it's Ethernet).