ZFS does not know which disk(s) caused the silent data corruption. It first assumes only 1 disk is bad and makes 4 attempts to rebuild it. It assumes successively each one of the 4 data stripes is bad, and rebuilds it from the parity stripes. But if it still cannot rebuild the correct data it means 2 disks are bad, so it tries 15 combinations of data/parity stripes to rebuild the 4 data stripes (well... minus the combination of "4 data stripes" which is already known bad, so the 14 other combinations are tested).