I cannot accept Matthew's answer because it's still suggesting one of the values I'm excluded from using - and I also believe 5xx errors aren't very appropriate where the error is in the client or the transport layer.
While still looking for better options, I'll for now propose (and use) a non-standard 4xx error, especifically
419 Checksum failed
That particular value is being chosen for its proximity to codes handling errors of a similar nature and similarity to 409 which is perhaps the closest relation.
An anser will be chosen after a couple days, to provide opportunity for community concensus on a best practice approach.