I don't understand the full details behind it.. but to my knowledge you can overflow the buffer but because code execution isn't returning from a function back to main() you will not be able to overwrite EIP. Correct me if I'm wrong but EIP is the 4bytes after EBP. If I overflow the buffer and view it in gdb I can't see that I wrote well over EBP but EIP remains unchanged.

    (gdb) run $(python -c 'print "a" * 270')
Starting program: /home/bob/C/Disassembler_Fun/SE_Vuln/se_vuln $(python -c 'print "a" * 270')

Program received signal SIGSEGV, Segmentation fault.
0x0040068b in main (argc=<error reading variable: Cannot access memory at address 0x61616161>, 
    argv=<error reading variable: Cannot access memory at address 0x61616165>) at se_vuln.c:10
10  }
(gdb) i r
eax            0x0  0
ecx            0x61616161   1633771873
edx            0xb7fbc870   -1208235920
ebx            0x61616161   1633771873
esp            0x6161615d   0x6161615d
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x40068b 0x40068b <main+139>
eflags         0x10286  [ PF SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

If I overflow a buffer in a program with a vulnerable function that returns execution somewhere (main()) I can overwrite EIP

    #include <string.h>

void vuln(char *arg) {
    char buffer[10];
    strcpy(buffer, arg);
}  

int main( int argc, char** argv ) {
    vuln(argv[1]);
    return 0; 
}

    (gdb) run $(python -c "print ('a' * 22) + ('b' * 4)")
Starting program: /home/bob/C/Disassembler_Fun/overflow $(python -c "print ('a' * 22) + ('b' * 4)")

Program received signal SIGSEGV, Segmentation fault.
0x62626262 in ?? ()
(gdb) i r
eax            0xbffff286   -1073745274
ecx            0xbffff520   -1073744608
edx            0xbffff296   -1073745258
ebx            0x61616161   1633771873
esp            0xbffff2a0   0xbffff2a0
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x62626262   0x62626262
eflags         0x10282  [ SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51
(gdb) 

Note the B's (0x42 is the hex for b) overwriting EIP. I guess this is the kind of overflow in your example can be used for a DOS attack but not necessarily code execution. I'd suggest enlarging the buffer in my example if you want to use it for tests involving storing a nop sled and shellcode in the buffer. Good luck have fun! Hope this helped.