I haven't written a test for this, but it seems that a peer can fingerprint a chunk of our mempool by announcing a new compact block with a valid header, but inserting many shorttxids that don't belong to the block but are suspected to be in our mempool. Assuming no short id collisions, we'll then request each tx that we didn't find in either vExtraTxnForCompact or the mempool.

I'm not sure how to fix this since compact block relay relies on this behavior. One possible way of fixing this was brought up here #27086 (comment).