What am I missing?

The reasons your tests '2@2qwert' and '2@@qwert' are incorrectly matching your regex is because there isn't anything in it that requires a minimum of 6 lowercase letters. Based on the other answers and comments to this question, I'd say replace your (?=.*[a-z]) clause with (?=(.*?[a-z]){6}).

Some other minor improvements that can be made:

• You can drop the redundant (?=.*[^a-z]) clause since all this is saying is that the string should contain at least 1 non-letter, which is already established by the digit and special character requirement.
• Replace [0-9] with \d.
• In the 3 places where you are matching wildcards prior to a character match (.*), it is slightly faster for the RegExp engine if these are made non-greedy so that there is less backtracking done when searching through the string for a match. This is done by placing a ? after the * (.*?).

Putting this together based on your regexp:

/^(?=.*?\d)(?=(.*?[a-z]){6})(?=.*?[@#$*])\S{8,}$/

This successfully matches your first 4 strings, but not the last 2.

(My original response is below in case you want a readable validate function.)

function validate(str)
{
  // test for digit
  if( !/\d/.test(str) ) return false;
  // test for special character
  if( !/[@#$*]/.test(str) ) return false;
  // test for 6 lowercase letters
  var letters = str.match(/[a-z]/g);
  return letters != null && letters.length == 6;
}

var tests = [ '2@qwerty', '#1asddfg', 'qwe*yt2u', '#qw2wqia', '2@2qwert', '2@@qwert' ];
for( var i=0 ; i<tests.length ; ++i )
  document.writeln(tests[i] + ": " + validate(tests[i]) + "<br/>\n");

Your breaking cases should break because they do not satisfy condition #3. Having said that, I think its probably easier to use a combination of JavaScript and Regex:

function isValid(input) {
  return (input && input.length === 8)             /* make sure its 8 characters */
         && /[0-9]/.test(input)                    /* make sure it contains at least one digit */
         && /[@#$*]/.test(input)                   /* make sure it contains at least one special character */
         && /([^a-z]*[a-z]){6}.*/.test(input);     /* make sure it contains at least 6 lower case chars */ 
}

console.log(isValid('2@qwerty'));    // true
console.log(isValid('#1asddfg'));    // true
console.log(isValid('qwe*yt2u'));    // true
console.log(isValid('#qw2wqia'));    // true
console.log(isValid('2@2qwert'));    // false
console.log(isValid('2@@qwert'));    // false
console.log(isValid('2@qwerty'));   // now true as it satisfies #3

Edit: Updated the check for minimum of 6 chars based on inputs from @Sniffer (it was interesting to learn something new, see comments!)

Well I came up with a regular expression that might do what you want but you may not like the look of it but the principle behind it is simple:

^(?=^.{8}$)(?=\D*[0-9])(?=[^@#$*]*[@#$*])(?=([^a-z]*[a-z]){6})\S{8}$

This expression first makes sure there is only 8 characters (?=^.{8}$).

Now the expression checks if there is a single number (?=\D*[0-9]) no more, then it makes sure there is one special symbol (?=[^@#$*]*[@#$*]).

Now the expression guarantees that there is 6 lower case characters (?=([^a-z]*[a-z]){6}).

So we have guaranteed there is one number, one special symbol and 6 lower case characters, the sum is 8 characters so the string should be valid.

This is not the best way to do it of course as you should probably break this operation into multiple steps but I wanted to try and do it with a single expression for the fun of it, if you found any problems please let me know.

This regex does what you need:

^(?=\D*\d\D*$)(?=[^@#$*]*[@#$*][^@#$*]*$)[@#$*\da-z]{8}$

It uses 2 look-aheads (anchored to start) to assert exactly 1 digit and 1 special, and a simple character class for all valid chars (times 8) so the rest must be lowercase (no need to count exactly 6).

See a live demo of your test cases on rubular.