As the document says, the zle variable CURSOR can only be in range [0, $#BUFFER].
Test code (put it into .zshrc, the ^[OP is F1):
testCursor() {
echo "\nOriginal C: $CURSOR"
BUFFER="a"
echo "Change Buffer: $CURSOR"
CURSOR=$((CURSOR+10))
echo "Force edit: $CURSOR"
CURSOR=100
echo "Force assign: $CURSOR"
}
zle -N testCursor
bindkey '^[OP' testCursor
The CURSOR satisfied it's range definition in runtime, how did the zsh-zle implements it?

The
CURSORvalue is handled in Zsh's source code, which is implemented in the C programming language: https://github.com/zsh-users/zsh/blob/3c93497eb701d8f220bc32d38e1f12bfb534c390/Src/Zle/zle_params.c#L266There is no way for you to declare a similarly constrained variable in Zsh shell code.
However, you can write a math function for it instead:
You can then use these in arithmetic statements, with this syntax:
But also in other contexts, with this syntax: