@edsantiago reports in containers/common#2202 (comment) , that we see

`TOC digest "sha256:…" for layer "…" is present but "expected-layer-diffid" flag is not a string

By code inspection, that might be possible if the image write+read both happen in the same process (we are writing a digest.Digest, and expecting a string).