Proposed resolution (approved by CWG 2024-04-19):

1. Add a new paragraph after 7.6.1.7 [expr.dynamic.cast] paragraph 6 as follows:

   If v is a null pointer value, the result is a null pointer value.

   If v has type "pointer to cv U" and v does not point to an object whose type is similar (7.3.6 [conv.qual]) to U, the behavior is undefined. If v is a glvalue of type U and v does not refer to an object whose type is similar to U, the behavior is undefined.

2. Change in 7.3.12 [conv.ptr] paragraph 3 as follows:

   A prvalue v of type “pointer to cv D”, where D is a complete class type, can be converted to a prvalue of type “pointer to cv B”, where B is a base class (11.7 [class.derived]) of D. If B is an inaccessible (11.8 [class.access]) or ambiguous (6.5.2 [class.member.lookup]) base class of D, a program that necessitates this conversion is ill-formed. The result of the conversion is a pointer to the base class subobject of the derived class object. The null pointer value is converted to the null pointer value of the destination type. If v is a null pointer value, the result is a null pointer value. Otherwise, if B is a virtual base class of D and v does not point to an object within its lifetime whose type is similar (7.3.6 [conv.qual]) to D, the behavior is undefined. Otherwise, the result is a pointer to the base class subobject of the derived class object.

(From submission #497.)

Base-to-derived casts and cross-casts need to inspect the vtable of a polymorphic type. However, this is not defined as an "access" and there is no provision for undefined behavior analoguous to 7.2.1 [basic.lval] paragraph 11.