You missed that they engineered the request so that the validation on the server side also overflows in the same way, thereby passing validation.