thanks everyone who have responded to my post.
I was wrong about the protection circuit. I did some research on the part CI237HA and tried to trace out how the protection circuit work by tapping the +ve and -ve signal out directly without passing through the protection circuitry.
1. Each channel (R/L) has two power tubes.
2. One power tube is a current amp for +ve signal, the other is for -ve signal.
3. The meter is to monitor the current throwing in the +ve signal power tube, not the -ve signal power tube.
4. The function of the CI237HA is to compare the current in each power tube.
5. If it detects a difference in current between +ve and -ve power tube, the protection circuit will be activated and the +ve signal path will be opened.
6. If the +ve signal path is opened, there is no current throw into our headphone, no matter it is in balance or single end both, in this way our headphone is protected.
7. We should not bypass the protection circuit.
I have tapped the +ve and -ve signal directly (from pin#3) to my single end earphone, one at a time and monitor the current throw in the power tubes. I can hear musics coming out as normal. That's great finding.
However, I have identified the current in the L channel power tube which is responsible for the -be signal is quite different from the other, and because of that, the protection circuitry is activated.
It seems I have some progress to identify the fault, I can now focus on only one amp section (not 4).