Outside of using the ldapSearch EcmaScript function is this possible?

From what I understand, to query rootDSE, you need to specify a blank
or null DN and search for objectClass=*

Geoffrey mentioned in an article that leaving the Class Name field in
the query token is effectively a wildcard search on objectClass

so.. why doesn't the following query work?

<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.15.5883">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<query scope="entry">
<read-attr/>
</query>
</input>
</nds>

Instead it returns the top level of the domain (the DC=domain,DC=com) level

<nds dtdversion="1.1" ndsversion="8.7">
<source>
<product asn1id="" build="20110211_120000"
instance="\IDV-TREE\ACME\Services\IDM\DriverSet\AD-TEST"
version="3.5.14">AD</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<instance class-name="domainDNS" event-id="0" src-dn="DC=ACME,DC=com">
<association>fd246292ceb3194c854d6453eab3ca2e</association>
</instance>
<status level="success"/>
</output>
</nds>

Is this a design limitation of the AD driver shim? Or is the query token
not capable of this?