Spec 1.03 (and rc 1.04.16) Part 3 define OptionSet writing in the validBits field (8.41, 1.04 text here):
validBits ByteString
"Array of bytes with same size as value representing the valid bits in the value
parameter.
When the Server returns the value to the Client, the validBits provides
information of which bits in the bit mask have a meaning. If a bit is 1 then the
corresponding bit in the value is used by the Server. If it is set to a 0 it should
be ignored as it has no meaning. When the Client passes the value to the
Server, the validBits defines which bits should be written. Only those bits
defined in validBits are changed in the bit mask, all others are not written.."

(sidenote, there probably should only be one '.' at the end)

These points are not explicitly specified (i.e. there is room for interpretation):

1) When writing, which validBits are taken?
A) validBits from the client value
B) validBits from the server existing value

2) What is the new validBits after the write operation in the server? It could be:
A) Only client side given validBits (if 1A)
B) Only the old validBits of the server before write
C) Combination of both validBits (if 1A and new validBits set)

I would assume 1A, however as the text mentions 'value', it could could mean either the complete DataValue or the value field of the OptionSet structure. It could also be 1B as text is not explicit which validBits are meant.

If the option for 2 is 2A, then there would be no point in making this complicated rule set as this would behave as a normal write of a Structure. However it is also the only option of 2 which would allow a client to turn a validBit off. If the intention is that this is not possible (i.e. 2B), it should in my opinion be mentioned in the text.

The specification does not mention what happens if a client sets validBits on to bits not defined in the server existing value.

I highly recommend that an example of a write would be added (before and after states)