It seems most likely that the corruption happened in RAM or the local storage device, after the TLS integrity check had already happened.