The following parameterized type should be considered malformed:

class C<T extends Number> {}
C<? extends String> test;

This is sort of implied by 4.5, but could be more clear.

Specifically, well-formedness relies on capturing C<? extends String> and then checking that the capture variable is a subtype of Number.  Capture, in turn, performs glb(String, Number), with this stipulation (5.1.10):

"It is a compile-time error if, for any two classes (not interfaces) Vi and Vj, Vi is not a subclass of Vj or vice versa."

In other words, in 4.5, the capture of C<T1,...,Tn> may be undefined.  It would be helpful to call this out as a possible condition under which the type C<T1,...,Tn> may be considered malformed.