It's not spelled out explicitly. Rather, what's missing from the standard is the requirement that a null pointer is all-bits-zero, or that reinterpret_cast'ing it to an integer type produces a zero (note that even these two are actually separate). This is deliberate - there have been platforms in the past where null pointer had a non-zero bit pattern for largely the same reasons (null address was valid and useful).

n1256.pdf, Section 6.3.2.3 Pointers, says "constant expression with the value 0".

  An integer constant expression with the value 0, or such an expression cast to type void *, is called a null pointer constant.

I don't think this definition excludes platforms that use non-zero bit patterns. A constant 0 in C code should get converted to the appropriate (possibly non-zero) bit-pattern for the platform.

Also, my understanding is that whether the platform has useful things at address 0 falls in the category of "implementation defined".

> Also, my understanding is that whether the platform has useful things at address 0 falls in the category of "implementation defined".

If address zero is a null pointer, then IIRC no allocated object, whether static, automatic or heap, can have that address - i.e pointers to them must always compare unequal to nullptr.

If null pointer is something other than address zero, then it's just a regular address, and can have anything - it's not even "implementation defined", not anymore so than saying that e.g. 0x12345678 is a valid object address on x86.

> I don't think this definition excludes platforms that use non-zero bit patterns.

It doesn't; the comment above yours is saying the same thing as you are.