C functions can only return one value. Since the stdlib generally adheres to the idea of minimizing overhead, that would mean malloc would have to accept a mutable reference to a reference, so it could assign the reference it returns. Since null references are unusable, using that impossible value as your error flag is a pretty clever optimization.
1. Why not just return meaningful values? Wouldn't that help in debugging?
2) ???
3) That makes sense to me.