The most common content type is SignedData: the content (or only a reference to it, for detached signatures), the signers' certificates and one SignerInfo per signer. A SignerInfo usually includes signed attributes — at least the content type and the messageDigest of the content, often a signing time — and the signature is computed over the DER encoding of those attributes, not over the content directly.
EnvelopedData encrypts content to recipients through per-recipient key transport (RSA), key agreement (ECDH) or, since RFC 9629, KEMs such as ML-KEM (RFC 9936). AuthEnvelopedData adds AEAD content encryption (RFC 5083). PEM labels are PKCS7 and CMS.
Most verification failures come from details: detached content that is not byte-identical to what was signed (line endings in S/MIME), a missing certificate chain, signed attributes re-encoded with a different SET OF ordering, or a digest algorithm the verifier no longer accepts. openssl cms -verify and the S/MIME verifier show which step failed.