As @solardiz noted in the followup post at https://www.openwall.com/lists/oss-security/2024/07/26/2 the standard unfortunately allowed the GNU libc behavior of not guaranteeing the pointer would be NULL on failure, requiring users to check the return value, despite all the known non-GNU implementations guaranteeing to set it to NULL on failure, meaning that even though the standard requires asprintf() be provided, portable software still has to be aware of the different implementations.