For other write commands, e.g. insert, we validate on mongod that there are <= maxWriteBatchSize ops in an incoming command, using checkOpCountForCommand (here). For example, InsertOp::validate (here) calls this.

However, we don't appear to enforce this limit for bulkWrite right now.

As far as I can tell, we don't enforce the limit for incoming commands on mongos, though we do ensure that outgoing commands on mongos respect the limit. So we likely only need to make a change on mongod, though it might be worth confirming this with the sharding team to make sure we didn't miss any logic around this. Update: Testing and further investigation revealed that the limits are in fact enforced on mongos. E.g. for insert, ClusterInsertCmdBase::parse calls BatchedCommandRequest::parseInsert which ends up calling down through to InsertOp::parse which calls validate and checks the op count.