Found a genuine bug in core: in the documented edge case, the value is cast and corrupted before any hook can intervene. Attached a clean 40-line patch with a failing test that the fix makes pass. Reproduces on a stock install.