And the CallbackCanceled error will propagate up to the client.

This is just weird behavior, not a data corruption issue. The weird behavior is that mongos will not retry the coordinateCommitTransaction command against a different node in the coordinator shard on getting back CallbackCanceled (it's not in the whitelist of retryable errors). Normally if the coordinator shard's primary steps down, mongos would automatically retry coordinateCommitTransaction against the new primary and the client would not have to do this itself.

Also, I am not sure what error label the client will get back along with CallbackCanceled. However, they can always rerun commitTransaction against mongos.