> While null-pointers are possibly under #1 it seems much more likely that you'd produce other kinds of invalid pointers(out of bounds, unaligned etc) than nullptr. The use of null pointers to signal absence and failure is surely the most common source of them in C (and relatives).

Fair point. Still, it just leaves a bitter taste when you want to express something as non-null but can't technically exclude it...