Let's say a coin has been locked with a 2-of-3 challenge script. In other words, spending the coin requires two signatures, each of which matches one of three designated public keys.

Now I try to spend the coin with a transaction containing, not two signatures, but three. All three signatures are valid and match a different designated public key.

The complete validation script will contain eight values:

<3>
<PK1>
<PK2>
<PK3>
<2>
<SIG1>
<SIG2>
<SIG3>
<0>

AFAIK, the only way for the interpreter to know the number of signatures is the value <2>, which was provided by the challenge script, not my response script. It seems that the only way for OP_CHECKMULTISIG to know how many signatures to pop is the value <2>.

However, popping only two values leaves the stack like this:

<SIG3>
<0>

Then the interpreter checks to see that the next value on the stack is 0, which it is not:

https://github.com/bitcoin/bitcoin/blob/0.10/src/script/interpreter.cpp#L894

As I understand it, this scenario should lead to failure of the verification script.

Is this correct?