glPushClientAttrib in GL_ARB_vertex_array_object

The GL_ARB_vertex_array_object is a new feature in opengl 3.0, I’m using the NV’s latest opengl 3.0 beta driver to verify its behavior, the result is as follows:

     glBindVertexArray(0);
     glBindBuffer(GL_ARRAY_BUFFER, 1);
     glVertexPointer(2, GL_FLOAT, 0, 16);
     glPushClientAttrib(GL_CLIENT_VERTEX_ARRAY_BIT);
     glGetIntegerv(GL_VERTEX_ARRAY_BUFFER_BINDING, &bufBinding); // here bufBinding is 1

     glBindVertexArray(1);
     glBindBuffer(GL_ARRAY_BUFFER, 2);
     glVertexPointer(2, GL_FLOAT, 0, 32);
     glPushClientAttrib(GL_CLIENT_VERTEX_ARRAY_BIT);
     glGetIntegerv(GL_VERTEX_ARRAY_BUFFER_BINDING, &bufBinding); // here bufBinding is 2
     
     glPopClientAttrib();

     // here bind to vao 0 again
     glBindVertexArray(0);
     glGetIntegerv(GL_VERTEX_ARRAY_BUFFER_BINDING, &bufBinding); // here bufBinding is 2, but not 1, why?

I’m confused that bufBinding in the last statement is 2, but not 1. Since the spec says that VA0s are server state, so what’s the behavior of glPushClientAttrib/glPopClientAttrib when VAO are used?

glspec 3.0 p10:
“Unless otherwise specified, all state referred to in this document is GL server state; GL client state is specifically identified.”

glspec 3.0 p47:
“2.9.3 Buffer Object State
The state required to support buffer objects consists of binding names for the array buffer, element buffer, pixel unpack buffer, and pixel pack buffer…”

In my opinion, binding names of array buffer should be a server state. It may be not changed with glPushClientAttrib/glPushClientAttrib.