It's possibly neither, since you could still hit the 8MB XML limitation with a 4MB ring_buffer configuration for max_memory which is the default. You also might be hitting a different bug in Extended Events that makes the timestamp get reported incorrectly that I blogged about here:
Incorrect Timestamp on Events in Extended Events
The only way to know which scenario you are running into is to add the action for collect_system_time to the events in the session and also add a file target to the session to capture all of the events in a media that isn't limited like the DMV is. I would point out that in SQL Server 2012, the system_health session has the file_target configured by default, so doing this in 2008 would be advisable IMO.