We have comparably decent test coverage and fuzzing confirmation for data integrity on decoding valid calldata encodings.
However, we have only sparse coverage for calldata validation, leading to bugs like #12907 going unnoticed.
While it is hard to test everything (this would mean checking all combinations between static and dynamic types up to three dimensions and in each verify the bounds checks for re-encoding, index accessing, copying to memory and copying to storage, resulting in an enormous test space), and we should also try to employ fuzzing for the validation part (see #12914), at least some more coverage in the unit tests would be good as well.