At least in my state they can only really confirm or deny that you worked for them.

That’s only in an official capacity. People can say whatever they want if it is a backdoor reference.