Makes sense. Do you happen to know of any way this can cause null pointer dereference to result in something other than SIGSEGV in a "normal" situation (userspace, modern POSIX system, modern hardware, no prior mmap(NULL, ..., MAP_FIXED, ...) call, no huge offset into the null pointer)? I can see how it would if you relax any of those conditions. In particular, I see an example of the deleted null check you're describing here: https://lwn.net/Articles/342330/

In any case, I'd still say strlen(NULL) is qualitatively different than check_ip_header_sum(malloc(4095), 4095). The former's undefined behavior is standard (strlen is expected to dereference the pointer, so it makes sense that it has whatever problems doing that has). The latter shouldn't be expected to exceed the stated bounds without that being clearly stated.