https://matrix.org/docs/spec/client_server/r0.6.1#post-matrix-client-r0-keys-query says that device_keys must be a map from string to a list of strings (the device IDs).

However, Synapse erroneously accepts other types in place of that list of strings (in particular, it accepts other maps).

In short: this is accepted as a valid request, where it should be rejected with a 400:

POST /_matrix/client/r0/keys/query HTTP/1.1

{
    "device_keys": {
        "@bob:hs1": {
            "device_id1": true,
        }
    }
}