@@ -57,6 +57,10 @@ API changes
 * Raw diffs preserve non-UTF-8 filename bytes in ``a_rawpath``, ``b_rawpath``,
   and raw rename fields. Staged-file diffs no longer fail while decoding legacy
   filenames; blob contents remain byte streams regardless of their encoding.
+  Text paths and rename properties use ``surrogateescape`` instead of replacing
+  undecodable bytes. Diff blob paths can be used for tree lookup, and renames
+  between distinct byte names are detected correctly. Patch rename fields
+  contain unquoted filename bytes.
 * Tree serialization now delegates construction to Git or the supported Gix
   backend. ``Tree.cache`` and ``TreeModifier`` edit one tree's in-memory entries;
   object IDs and parent trees do not change automatically. Prefer
 
@@ -10,7 +10,7 @@
 
 from git import _backend
 from git.cmd import Git, handle_process_output
-from git.compat import defenc
+from git.compat import defenc, safe_decode
 from git.objects.base import IndexObject
 from git.objects.blob import Blob
 from git.objects.util import mode_str_to_int
@@ -486,7 +486,7 @@ def __init__(
         # we need to overwrite "repo" to the corresponding submodule's repo instead.
         if repo and a_rawpath and (self.a_mode == 0o160000 or self.b_mode == 0o160000):
             for submodule in repo.submodules:
-                if submodule.path == a_rawpath.decode(defenc, "replace"):
+                if submodule.path == safe_decode(a_rawpath):
                     if submodule.module_exists():
                         repo = submodule.module()
                     break
@@ -582,24 +582,24 @@ def __str__(self) -> str:
 
     @property
     def a_path(self) -> Optional[str]:
-        return self.a_rawpath.decode(defenc, "replace") if self.a_rawpath else None
+        return safe_decode(self.a_rawpath) if self.a_rawpath else None
 
     @property
     def b_path(self) -> Optional[str]:
-        return self.b_rawpath.decode(defenc, "replace") if self.b_rawpath else None
+        return safe_decode(self.b_rawpath) if self.b_rawpath else None
 
     @property
     def rename_from(self) -> Optional[str]:
-        return self.raw_rename_from.decode(defenc, "replace") if self.raw_rename_from else None
+        return safe_decode(self.raw_rename_from) if self.raw_rename_from else None
 
     @property
     def rename_to(self) -> Optional[str]:
-        return self.raw_rename_to.decode(defenc, "replace") if self.raw_rename_to else None
+        return safe_decode(self.raw_rename_to) if self.raw_rename_to else None
 
     @property
     def renamed_file(self) -> bool:
         """:return: ``True`` if the blob of our diff has been renamed"""
-        return self.rename_from != self.rename_to
+        return self.raw_rename_from != self.raw_rename_to
 
     @classmethod
     def _pick_best_path(cls, path_match: bytes, rename_match: bytes, path_fallback_match: bytes) -> Optional[bytes]:
@@ -742,8 +742,8 @@ def finalize_process_with_stderr(proc: Union["Popen", "Git.AutoInterrupt"]) -> N
                     new_file,
                     deleted_file,
                     copied_file,
-                    rename_from,
-                    rename_to,
+                    decode_path(rename_from, has_ab_prefix=False) if rename_from else None,
+                    decode_path(rename_to, has_ab_prefix=False) if rename_to else None,
                     None,
                     None,
                     None,
 
@@ -9,6 +9,7 @@
 import pytest
 
 from git import NULL_TREE, Diff, DiffIndex, Diffable, Repo
+from git.compat import safe_encode
 from git.diff import decode_path
 from git.exc import UnsafeOptionError
 
@@ -36,6 +37,22 @@ def test_raw_diff_preserves_non_utf8_paths(change):
         assert (diffs[0].raw_rename_from, diffs[0].raw_rename_to) == (before, after)
 
 
+@pytest.mark.parametrize("create_patch", [False, True])
+@pytest.mark.parametrize("quote_path", ["false", "true"])
+def test_diff_paths_and_renames_preserve_non_utf8_bytes(create_patch, quote_path):
+    with fixture_repo("diff-byte-paths.sh", quote_path) as repo:
+        before, after = repo.commit("HEAD^"), repo.head.commit
+        (diff,) = before.diff(after, create_patch=create_patch)
+        assert (diff.a_rawpath, diff.b_rawpath) == (b"legacy-\xff", b"legacy-\xfe")
+        assert (diff.raw_rename_from, diff.raw_rename_to) == (diff.a_rawpath, diff.b_rawpath)
+        assert (safe_encode(diff.a_path), safe_encode(diff.b_path)) == (diff.a_rawpath, diff.b_rawpath)
+        assert (safe_encode(diff.rename_from), safe_encode(diff.rename_to)) == (diff.a_rawpath, diff.b_rawpath)
+        assert diff.renamed_file
+        if not create_patch:  # Exact-rename patches omit the blob IDs.
+            assert before.tree[diff.a_blob.path].binsha == diff.a_blob.binsha
+            assert after.tree[diff.b_blob.path].binsha == diff.b_blob.binsha
+
+
 @ddt.ddt
 class TestDiff(TestBase):
     def setUp(self):
@@ -351,7 +368,7 @@ def test_diff_unsafe_paths(self):
         self.assertEqual(res[8].b_path, "path/¯\\_(ツ)_|¯")
         self.assertEqual(res[9].b_path, "path/💩.txt")
         self.assertEqual(res[9].b_rawpath, b"path/\xf0\x9f\x92\xa9.txt")
-        self.assertEqual(res[10].b_path, "path/�-invalid-unicode-path.txt")
+        self.assertEqual(safe_encode(res[10].b_path), b"path/\x80-invalid-unicode-path.txt")
         self.assertEqual(res[10].b_rawpath, b"path/\x80-invalid-unicode-path.txt")
 
         # The "Moves"
 
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -eu
+git init --initial-branch=main repo
+cd repo
+git config core.quotePath "$1"
+blob=$(printf 'content\n' | git hash-object -w --stdin)
+before=$(printf '100644 blob %s\tlegacy-\377\0' "$blob" | git mktree -z)
+after=$(printf '100644 blob %s\tlegacy-\376\0' "$blob" | git mktree -z)
+parent=$(printf 'before\n' | git commit-tree "$before")
+commit=$(printf 'after\n' | git commit-tree "$after" -p "$parent")
+git update-ref refs/heads/main "$commit"