Stefan Beller [off-list ref] writes:
$ git hash-object --stdin -w -t commit <<EOF
tree c70b4a33a0089f15eb3b38092832388d75293e86
parent 105d5b91138ced892765a84e771a061ede8d63b8
author Stefan Beller [off-list ref] 1519859216 -0800
committer Stefan Beller [off-list ref] 1519859216 -0800
tree 5495266479afc9a4bd9560e9feac465ed43fa63a
test commit
EOF
19abfc3bf1c5d782045acf23abdf7eed81e16669
$ git fsck |grep 19abfc3bf1c5d782045acf23abdf7eed81e16669
$
So it is technically possible to create a commit with two tree entries
and fsck is not complaining.
The second one is merely a random unauthorized header that is not
interpreted in any way by Git. It is merely being confusing by
starting with "tree " and having 40-hex after it, but the 40-hex
does not get interpreted as an object name, and does not participate
in reachability computation (i.e. packing, pruning and fsck).
There is not much difference between that and a line of trailer in
the commit log message (other than this one is less discoverable).