“Since 2012, musl libc’s crypt function has returned the string “*” for a password that’s too long for it to hash.”
A locked account’s hash is also “*”. So a long enough password matches it, and the door opens. This sat in libc for fourteen years and works on the official Alpine AWS image. No buffer overflow involved. Just C’s habit of returning magic strings instead of errors, and everyone downstream trusting them.