It seems that the BIP32 derivation code (https://github.com/bitpay/bitcore-lib/blob/master/lib/hdprivatekey.js#L193) doesn't do any checks against the validity of the generated private key.

https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#private-parent-key--private-child-key:

In case parse256(IL) ≥ n or ki = 0, the resulting key is invalid, and one should proceed with the next value for i. (Note: this has probability lower than 1 in 2127.)