IsWitnessStandard rejects tapscript stack items over 80 bytes and an empty control block, and no test asserts bad-witness-nonstandard for either. With the 80-byte check removed, feature_taproot.py failed on only 6 of the ten seeds I tried, and with the empty control block check removed it can't fail at all, since none of its spenders has an empty control block. Without that check the node segfaults reading control_block[0].
This adds a case for each to mempool_accept.py, by mutating the witness of the P2TR script-path spend the file already builds. Each case fails with its policy.cpp branch disabled and passes with it restored.