The regex for validating bonding interface mode uses an unescapted dot in 802.3ad, which means it's interpreted as "any character" rather than a literate dot, so it's possible to set the mode to something like 802%3ad and the typo will remain hidden until the user commits.
vyos@dmbaturin-vpn-gw# set interfaces bonding bond0 mode 802.4ad # typo s/3/4/ — caught immediately mode must be 802.3ad, active-backup, broadcast, round-robin, transmit-load-balance, adaptive-load-balance, or xor Value validation failed Set failed [edit] vyos@dmbaturin-vpn-gw# set interfaces bonding bond0 mode 802%3ad <NO ERROR>