Copy/paste bug in ReadTypeDefOrRefEncoded(). Note that this is a low impact bug, because ironically in most places where TypeDefOrRefEncoded is used a TypeSpec isn't legal, only in custom modifiers (where it isn't specified in the spec) is it allowed to use a TypeDefOrRefEncoded token that refers to a TypeSpec.

reflect/Signature.cs

@@ -569,7 +569,7 @@ namespace IKVM.Reflection
 				case 1:
 					return module.ResolveType((TypeRefTable.Index << 24) + (encoded >> 2), null, null);
 				case 2:
-					return module.ResolveType((TypeRefTable.Index << 24) + (encoded >> 2), context);
+					return module.ResolveType((TypeSpecTable.Index << 24) + (encoded >> 2), context);
 				default:
 					throw new BadImageFormatException();
 			}