NULL can never be part of the same "array object" or one past past the last element as the pointer it is subtracted from. Hence the undefined beaviour.
Even more fundamentally, NULL is not 0 in any ordinary mathematical sense, even though it can be written 0 in source code and is often (but not always) represented in memory as an all-0s bit pattern. I'm not at all surprised to learn that arithmetic involving NULL is undefined.
