[basic.compound]/3 says:

Every value of pointer type is one of the following:
…
— a pointer past the end of an object ([expr.add]), or
…
For purposes of pointer arithmetic ([expr.add]) and comparison ([expr.rel], [expr.eq]), a pointer past the end of the last element of an array x of n elements is considered to be equivalent to a pointer to a hypothetical array element n of x

However, there is nothing normative about pointers past the end in [expr.add]. [expr.add]/4 says:

When an expression J that has integral type is added to or subtracted from an expression P of pointer type, the result has the type of P.
…
— Otherwise, if P points to an array element i of an array object x with n elements ([dcl.array]),⁷⁷ the expressions P + J and J + P (where J has the value j) point to the (possibly-hypothetical) array element i+j of x if 0≤i+j≤n and the expression P - J points to the (possibly-hypothetical) array element i−j of x if 0≤i−j≤n.
…
77) As specified in [basic.compound], an object that is not an array element is considered to belong to a single-element array for this purpose and a pointer past the last element of an array of n elements is considered to be equivalent to a pointer to a hypothetical array element n for this purpose.

[basic.compound] says that a pointer past the end of the last element of an array of n elements is considered to point to hypothetical element n of the array, whilst [expr.add] is worded in the way that one should guess that when it speaks about a pointer to possible-hypothetical array element, it means the case when i+j or i-j is equal to n and that we got pointer past the end of the last element of the array. The logics is kinda reversed here.

Feels like NAD, but just in case…