Decode the three values, range check them and reject before doing any group arithmetic. Record the rejection cases as named tests, including a non canonical point, a point not on the curve, a value at the order and a value above it. This is the clause that decides whether a malformed signature can be treated as valid.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.