is this RSA private key valid?
This is, as you guessed, an incorrectly encoded key.  I suspect that OpenSSL ASN.1 decoder is written to assume that the modulus (and other parameters) is always positive, and so interprets them as if they were (that is, interprets them as if the leading 00 byte was there); hence it just happens to work.

Now, what do you do about it?  Well, if it's basically working for you, I suppose there's no urgent need to "fix" it.  On the other hand, what you're using isn't standard ASN.1; if you need to give the private key to someone else (or even update the version of OpenSSL you're using), it might stop working.  I'd personally suggest that you track down who generated the key, and tell them to fix their ASN.1 encoder.