FWIW, my policy is that 5xx codes are always bugs, or an infrastructure-level failure/refusal to serve.

4xx codes are processing errors, or application-level refusals.

I end up borrowing 422 from WebDAV for a generic "Unprocessable Entity", with an error code (for API interpretation/reference lookup) and description (for user display, when appropriate) in the response body.