cfssl pathlen weirdness

.gitignore

*.pem
*.csr

ca-csr.json

{
    "CN": "My Root CA",
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "GB",
            "L": "Bristol",
	    "O": "Acme Software Ltd.",
            "ST": "England",
	    "OU": "Support"
        }
    ],
    "CA": {
	"pathlen": 0
    }
}

config.json

{
    "signing": {
        "default": {
            "expiry": "2160h"
        },
        "profiles": {
            "intermediate": {
                "usages": [
                    "signing",
                    "cert sign",
                    "crl sign"
                ],
                "expiry": "2160h",
                "is_ca": true
            }
        }
    }
}

generate.sh

#!/bin/sh
cfssl gencert -initca ca-csr.json 2>out-ca.txt | cfssljson -bare ca - 
cfssl gencert -ca ca.pem -ca-key ca-key.pem -config config.json -profile="intermediate" int-csr.json 2>>out-int.txt | cfssljson -bare int - 

int-csr.json

{
    "CN": "My Intermediate CA",
    "hosts": [
	""
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "GB",
            "L": "Bristol",
	    "O": "Acme Software Ltd.",
            "ST": "England",
	    "OU": "Support"
        }
    ],
    "CA": {
	"pathlen": 0
    }
}

out-ca.txt

2016/04/06 21:43:29 [INFO] generating a new CA key and certificate from CSR
2016/04/06 21:43:29 [INFO] generate received request
2016/04/06 21:43:29 [INFO] received CSR
2016/04/06 21:43:29 [INFO] generating key: ecdsa-256
2016/04/06 21:43:29 [INFO] encoded CSR
2016/04/06 21:43:29 [INFO] signed certificate with serial number 490740001196759146705435558794779121141306255599

out-int.txt

ca section only permitted in initca

[ca section only permitted in initca]
what does this mean？