The fuzzer can generate commands with the same field at the top-level and in the $queryOptions sub-object. Rpc::upconvertRequest() moves fields from the sub-object to the top-level, which later triggers an fassert due to there being duplicate fields. upconvertRequest() should throw ErrorCodes::InvalidOptions instead to prevent duplicate fields at the top-level.