OpenSSL converted certificate with incorrect subnet mask

I used the format conversion command of openssl to convert the der certificate to a pem certificate for verification. For my test case, the conversion and verification commands were all executed successfully, but this test case does not comply with RFC5280. In the Nameconstrains extension, a non-compliant mask appears. I think this is a bug.

$ openssl x509 -inform DER -in E_mask.der -out E_mask.pem $ openssl verify -CAfile E_maskCA.pem E_mask.pem E_mask.pem: OK

I have provided the test case in the attachment This test case uses an incorrect subnet mask as the value of Nameconstraints Case.zip