It can also corrupt state if the target clients are light (and only verify headers).