Drupal 8's normalizers' denormalize() implementations throw UnexpectedValueException to indicate unexpected values in the received data, which cannot be denormalized to corresponding PHP objects. Such exceptions should result in a 422 response: \Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException.

Sadly, the same exception is used in Symfony's encoders/decoders — it is thrown by:

• \Symfony\Component\Serializer\Encoder\JsonDecode::decode()
• \Symfony\Component\Serializer\Encoder\JsonEncode::encode()
• \Symfony\Component\Serializer\Encoder\XmlEncoder::buildXml()
• \Symfony\Component\Serializer\Encoder\XmlEncoder::decode()

… yet encoding/decoding problems should result in a 400 response: \Symfony\Component\HttpKernel\Exception\BadRequestHttpException.

The official docs don't mention 422 responses or (de)normalization failures either: http://symfony.com/doc/current/components/serializer.html + http://symfony.com/doc/current/serializer.html.