The documentation for `decode` states:

"If the code point is not well-formed, then a UTFException is thrown and index remains unchanged."

However, fuzzing with /dev/urandom found that this

import std.conv;
import std.format;
import std.utf;

void main() {
    string data = hexString!"f787a598";
    size_t offset = 0;
    try
    {
        data.decode(offset);
    } catch (UTFException ex) {
        assert(offset == 0, "offset changed to %s despite exception %s".format(offset, ex.msg));
    }
}

fails.