Pointless, but not dangerous
In order to understand the answer to the problem, we need to understand how certificates work. When a program encounters a certificate and it wants to verify the authenticity of it, it looks at the certificate itself, as well as the Issuer of that certificate (aka. the one who signed it).
That process is repeated until either:
- A trust anchor is found (Success)
- A validation error occurs (Failure)
- A certificate is missing (Failure)
- The top is reached an no trust anchor is found (Failure)
This means, if I have a certificate "Leaf", signed by "Branch", signed by "Root", then I need to verify three certificates. In order for this process to succeed, a trust anchor needs to be found. 99% of the time this will be "Root". Since I already need to be aware of "Root", there is no need for the certificate chain to include "Root".
Some examples to illustrate
Leaf + Branch are sent
This is the typical scenario. A client would first verify "Leaf", then verify "Branch" and finally search for "Root" in its own trust store. If "Root" is found, then "Leaf" is a trusted certificate (assuming all other data is valid). If "Root" is not found in the trust store, then the certificate is not trusted.
Leaf + Branch + Root are sent
This is what you referred to as the "fullchain" scenario. Verification works the exact same way. If "Root" is found in the trust store, then "Leaf" will be trusted. If it is not found, then it will not be trusted.
Leaf + Root are sent
This scenario is most likely a configuration error. When "Leaf" is being verified, the program would then attempt to verify "Branch". Since this certificate is missing, the verification fails, even though "Leaf" is valid. The fact that "Root" exists doesn't matter to the verification process, as the link between "Leaf" and "Root" can't be established.
Leaf is sent
This scenario is also a configuration error, but a far more common one than above. The outcome is the same nonetheless, since "Leaf" depends on "Branch", which is missing.
You can send the full certificate chain or omit the root certificate. It has no security implications, although sending the root certificate is pointless and just wastes bandwidth.