The current wording of the bullet list in [except.handle]p3 makes it impossible to have a catch handler of pointer type initialized with an E of type std::nullptr_t.

A handler is a match for an exception object of type E if

• The handler is of type cv T or cv T& and E and T are the same type (ignoring the top-level cv-qualifiers), or
• the handler is of type cv T or cv T& and T is an unambiguous public base class of E, or
• the handler is of type cv T or const T& where T is a pointer type and E is a pointer type that can be converted to T by either or both of
  • a standard pointer conversion (4.10) not involving conversions to pointers to private or protected or ambiguous classes
  • a qualification conversion
• the handler is of type cv T or const T& where T is a pointer or pointer to member type and E is std::nullptr_t

Even though the wording explicitly mentions a cv T being initialized with an E of type std::nullptr_t, such behavior is disallowed because there's a missing ", or" in the previous bullet.

I propose a reorder of the last two bullets, and appending ", or" to make it clear that the section is talking about two different types of exception matches.

A handler is a match for an exception object of type E if

• The handler is of type cv T or cv T& and E and T are the same type (ignoring the top-level cv-qualifiers), or
• the handler is of type cv T or cv T& and T is an unambiguous public base class of E, or
• the handler is of type cv T or const T& where T is a pointer or pointer to member type and E is std::nullptr_t, or
• the handler is of type cv T or const T& where T is a pointer type and E is a pointer type that can be converted to T by either or both of
  • a standard pointer conversion (4.10) not involving conversions to pointers to private or protected or ambiguous classes
  • a qualification conversion.