The spec requires collection name in a DBPointer type to be a "string" – i.e. a length + bytes + 0x00. libbson doesn't verify that the null byte is actually null. It appears to just skip over it.

Here is an example of a BSON string with valid DBPointer as visualized with 'bsonview' in the BSON corpus spec:

1A0000000C610002000000620056E1FC72E0C917E9C471416100
 1a000000 0c "a" 00 02000000 "b" 00 56E1FC72E0C917E9C4714161 00

Here is a slightly modified version of the above (a case that should fail to parse according to the spec). Instead of 0x00, the trailing "null" of the collection name is 0x62 (marked with ^^):

1A0000000C610002000000626256E1FC72E0C917E9C471416100
 1a000000 0c "a" 00 02000000 6262 56e1fc72e0c917e9c471416100
                               ^^

libbson considers the latter case to be a valid DBPointer.