Two GetString calls on identical input must return byte-identical Go strings; a regression in the Unescape path (surrogate-pair handling diverging between stack and heap allocations) produces different decoded output.

GetString on an empty JSON string value ("") regresses to returning NullValueError or an empty slice instead of the empty Go string, breaking the empty-string boundary.

GetString on a zero-length []byte drives Get to internalGet to nextToken=-1; the follow-on getType dereference panics with index-out-of-range on the empty slice.

Malformed UTF-8 inside a JSON string value (lone continuation byte) is passed through Unescape without normalization; the returned Go string contains invalid UTF-8, corrupting downstream string operations.

Adversarial JSON like {"k":"\\q"} drives Unescape to MalformedStringEscapeError; if error propagation regresses, GetString returns a corrupt decoded string or panics on the bad escape offset.

GetString(nil, ...) flows straight through Get to internalGet to searchKeys nil-slice loop; getType(nil,0) data[offset] dereference panics with nil-slice index-out-of-range.

Truncated \u escape at end of string ("abc\u31") drives Unescape hex-digit scan past the buffer end; if the bounds check regresses the parser reads past len(data) and panics with slice-bounds error.

GetString on a JSON Number or Boolean returns the documented type error or silently coerces the raw bytes; callers expecting a string field read garbage from a numeric value.