This is presumably a bug in json.indirect function (at encoding/json/decode.go). If a struct has an Unmarshal function—whether explicit or inherited—it returns that function which is further used to unmarshal the entire struct.
You'd mention json.Unmarshaler, I think. BTW, the godoc specifies:
To unmarshal JSON into a value implementing the Unmarshaler interface, Unmarshal calls that value's UnmarshalJSON method, including when the input is a JSON null.
So, yes! According to the document, since req is implementing json.Unmarshaler (borrowing it from Q), the behavior is expected. However, I'd recommend to raise a warning or be more specific in the document, since this behavior is prone to errors.
On top of that, the encoding/json package has no way to know, in general, whether your UnmarshalJSON method consumed the entire JSON object or not. (For all we know, you're parsing some of the fields via a recursive call to json.Unmarshal and others by pulling out the fields directly.)