Outside of using the ldapSearch EcmaScript function is this possible?

From what I understand, to query rootDSE, you need to specify a blank
or null DN and search for objectClass=*

Geoffrey mentioned in an article that leaving the Class Name field in
the query token is effectively a wildcard search on objectClass

so.. why doesn't the following query work?

<nds dtdversion="3.5" ndsversion="8.x">
<product version="">DirXML</product>
<contact>Novell, Inc.</contact>
<query scope="entry">

Instead it returns the top level of the domain (the DC=domain,DC=com) level

<nds dtdversion="1.1" ndsversion="8.7">
<product asn1id="" build="20110211_120000"
<contact>Novell, Inc.</contact>
<instance class-name="domainDNS" event-id="0" src-dn="DC=ACME,DC=com">
<status level="success"/>

Is this a design limitation of the AD driver shim? Or is the query token
not capable of this?