So we are doing role validation here https://github.com/moodle/moodle/blob/master/admin/tool/uploadcourse/classes/course.php#L1110 which is after instance is created. We should move it earlier so instance is not created if role is invalid.

This will not affect currently supported enrolment methods for course upload (manual, guest, self). Those methods are pretty relaxed on role - i.e. we can have wrong context level like block, but we already have test for that. But it can affect third party code if they extend upload course to use other methods. And we are also extending upload course to include cohorts enrolment in MDL-73839 - thats how the bug was found. So we can have a situation when csv have bad role like it belongs to different cohort/category, but cohort enrolment instance will created with default role which is totally avoidable - better to not create at all and notify a user

So problem is here course.php #1056 first it creates instance with default role setting and then it fixes role later here course.php #1111 It is ok for manual, guest and self since its not possible to have situation when role is allowed at some category level, but not on other category. But in case of cohort enrolments such situation is entirely possible. Since its not possible to get the error with current code I created a patch to test it