> By contrast a negative leap second, should one occur, will cause a permanent illegal time_t value that has no existence in UTC. Checking for that illegal value in every piece of code that uses time_t values will not be fun.

Positive leap seconds, when translated into a dumb format and back, can be off by a second and won't round trip properly.

Negative leap seconds, when translated out of a dumb format and back, can be off by a second and won't round trip properly.

Seems pretty close to me.