Pointer subtraction is only valid for pointers within the same object. To overflow a signed ptrdiff_t, you'd need to allocate an array of char with more than 2^31 elements. This can be done on some systems, but it's really rare.
> For multiplication, I think the math works out the same for unsigned and signed, within mod bit-size and you throw away the "overflow"?
Yeah, true. I recalled there being separate instructions and then messed up my napkin math to check if it made a difference within the relevant range.
For greater-than/smaller-than comparisons, I see the utility of working in the signed space though. I guess it all depends on expectations. If you have a pointer to the very last byte of a 2^32 address space (0xFFFF_FFFF), and subtract a pointer to the second byte from the start (0x0000_0001), you'll end up with a diff that should be "SIZE_MAX-2", but will be parsed as "-2" in the signed interpretation.