It depends on where the data was changed and all you mentioned outcomes are possible. TLS messages has some public scructure. For example, TLS record:
and if its structure is broken, then entire message is considered broken. This doesn't necessarily say if encrypted data was additionally tampered.
If only ciphertext was tampered so entire structure remains valid, it may result in decryption failure. If payload is tampered and was successfully decrypted, then signature validation will fail.
If MAC field is tampered, then it will result in signature validation failure. MAC protects only payload and is used only when payload is successfully decrypted.
Either way, tampering will be detected, only detection reason will be different depending on what exactly was tampered. RFC 5246 defines a set of messages:
unsupported_extension(110), /* new */