On the other hand - P1 says that ejabberd is unaffected and they most likely won't return 'policy-violation'. It's our invention after all, because I don't think it is specified (at least I can't find it) what server should do when zlib bomb is suspected.