TLS certificate validation now explicitly checks for the basicConstraints extension. Certificates missing this extension are rejected with: "Certificate is missing basicConstraints extension and cannot be used as a CA."
Evidence
New validation check (search for "Certificate is missing basicConstraints extension")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.