git-fsck tests SHA-1 and general object sanity, and it does full tracking
of the resulting reachability and everything else. It prints out any
corruption it finds (missing or bad objects), and if you use the
--unreachable flag it will also print out objects that exist but that
aren’t reachable from any of the specified head nodes (or the default
set, as mentioned above).
Any corrupt objects you will have to find in backups or other archives
(i.e., you can just remove them and do an rsync with some other site in
the hopes that somebody else has the object you have corrupted).
If core.commitGraph is true, the commit-graph file will also be inspected
using git commit-graph verify. See git-commit-graph(1).