TJA1042T CAN Transceiver: CANH/CANL Short to BATT or GND Behavior and RXD Output

I was just trying to understand the CAN transceiver TJA1042T behavior during fault conditions: 
1)CANH short to BATT

2)CANH short to GND

3)CANL short to BATT

4)CANL short to GND

Please see the attachment for the internal block diagram of the CAN transceiver.
I'm powering on the transceiver IC and giving the TXD signal from the signal generator (a 0-5V square wave) and I'm monitoring the CANH, CANL and RXD lines of the transceiver.

During CANH short to battery, what I'm observing is that the CANL signal is also moving up to battery level during '1' bit transmission(recessive state) and during'0' bit transmission(dominant state) it is going down to a voltage level about 3.5V , so the differential voltage is about 8.5V (Battery voltage = 12V), and the RXD signal matches with the TXD signal, so the communication is still possible with CANH short to battery with the differential voltage being as high as 8.5V. (I'm trying to explain my observations, since unfortunately I cannot share the oscilloscope captures)

During CANH short to GND, I expected the communication to stop but what I observed is that when CANH is short to GND CANL voltage level is also moving to GND during recessive state, and during dominant state the CANL is actually going negative to about -2.45V for a short duration and tries to got back to GND level ,so it's like a negative ramp signal and the RXD signal matches the TXD, the communication is still possible.

During CANL short to battery,CANH signal is also reaching battery level during '1' bit transmission(recessive state) and during '0' bit transmission CANH voltage level is about 3V higher than the battery level for a very short during and reaching back to battery level , so the RXD signal is not excatly matching the TXD (what I mean when I say this is that is the TXD is high for 2us, the RXD is high for only about 500ns) , so the communication is interuppted.

During CANL short to GND, CANH signal also goes down to GND level during '1' bit transmission(TXD high) and CANH reaches about 3V during '0' bit transmission(TXD Low) so the differential voltage is 3V and RXD signal matches the TXD, the communication is uninterrupted.

If someone could explain to me how the voltage levels of CANH and CANL were shifting in all the cases, and how the CANL signal was going negative during CANH short to GND to maintain the differential volatge to interpret '0' bit transmission.

Here's the datasheet of the transceiver:

https://www.nxp.com/docs/en/data-sheet/TJA1042.pdf

And the application note:

https://www.nxp.com/docs/en/supporting-inform...4_v1_4_Application_Hints_TJA1042_43_48_51.pdf

In the application note, I found the pin FMEA for short circuit conditions as below:

Screenshot from the app note is attached.
One observation during my testing which contradicts the table above is the condition 2) CANH short to GND, where I've observed that communication is still possible as opposed to what is given in the table above.