Well there's two places responsible if you read the Solaris bug. Xvesa is only sending a keypress event (like the earlier Solaris X server it seems), not keypress + keyrelease, which then confuses fluxbox as fluxbox is doing its own tracking in a weird way.
The protocol specifies a separate field for modifiers, like "is control pressed", and there's a numlock entry in there too. So why fluxbox is tracking numlock state by the keypresses is weird, but it's also weird why the WM cares about numlock at all.