I think the answer to this question, although probably not the answer you really need, is that it is incomplete or poorly specified, so we can’t say whether the examples you cited are poorly formed or cause undefined by current draft standard.
We can see this by looking at DR 232 and DR 453 .
DR 232 reports that there are standard conflicts regarding whether to translate a null pointer to undefined behavior:
At least a few places in the IS state that direct via null pointer produce undefined behavior: 1.9 [intro.execution] in clause 4 gives "dereferencing of a null pointer" as an example undefined and 8.3.2 [dcl.ref], clause 4 (in a note) uses this supposedly undefined behavior as an excuse for the non-existence of “null references”.
However, clause 5.3.1 [expr.unary.op], which describes the unary Operator "*", does not say that the behavior is undefined if the operand is a null pointer, as one would expect. In addition, at least one pass gives the dereference of the correct behavior of the null pointer: 5.2.8 [expr.typeid], clause 2, says
and introduces the concept of an empty lvalue, which is the result of an indication on a null pointer or one after the end of the array:
If there are any. If the pointer has a null pointer value (4.10 [conv.ptr]) or points one after the last element of an array object (5.7 [expr.add]), the result is an empty lvalue and does not refer to any object or function.
and suggests that this type of lvaue-rval conversion be undefined.
and DR 453 tell us that we don’t know what a real object is:
What is a "valid" object? In particular, the expression "real object" seems to exclude uninitialized objects, but the answer to Core Issue 363 clearly says that it is not an intention.
and assumes that linking a reference to an empty value is undefined behavior.
If the value of l to which the link is directly attached does not indicate an existing object or function of the corresponding type (8.5.3 [dcl.init.ref]), as well as a memory area of suitable size and alignment, contain an object of the reference type (1.8 [intro.object] , 3.8 [basic.life], 3.9 [basic.types]), undefined behavior.
and includes the following examples in the sentence:
int& f(int&); int& g(); extern int& ir3; int* ip = 0; int& ir1 = *ip;
So, if we want to limit ourselves to actions only with intent, I feel that DR 232 and DR 453 provide the information we need to say that the intention is that null pointer conversion lvalue-rvalue is undefined behavior and reference to null pointer or undefined The value is also undefined.
Now, although it took some time to resolve both of these resolutions, they are both active with relatively recent updates, and the committee does not seem to agree with the basic premise that the reported defects are actual defects. Therefore, not knowing these two elements, this implies that it is impossible to answer your question using the current project standards.