if the preimage in a fulfill is not valid, you should resend the COND, and log that that peer is sending you invalid preimages. it's a bit of a hassle that the server that has the bug does not get a hint about the reason why the other server keeps sending the CONDs, but they operators will just have to compare logs, then.
in theory we could add a reason to a PLEASE-FINALIZE message, maybe, but writing that here as just a thought and not a proposal; let's keep things simple for now.
if the preimage in a fulfill is not valid, you should resend the COND, and log that that peer is sending you invalid preimages. it's a bit of a hassle that the server that has the bug does not get a hint about the reason why the other server keeps sending the CONDs, but they operators will just have to compare logs, then.