dlsym.3: Extend discussion of NULL symbol values

Avoid implying that use of IFUNC is the only way to produce a
symbol with NULL value. Give more scenarios how a symbol may get
NULL value, but explain that in those scenarios dlsym() will fail
with Glibc's ld.so due to an implementation inconsistency.

Signed-off-by: Alexander Monakov <amonakov@ispras.ru>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

man3/dlsym.3

@@ -143,16 +143,22 @@ The
 .BR dlvsym ()
 function is a GNU extension.
 .SH NOTES
-The value of a symbol returned by
-.BR dlsym ()
-will never be NULL if the shared object is the result of normal compilation,
-since a global symbol is never placed at the NULL address.
-There are nevertheless cases where a lookup using
-.BR dlsym ()
-may return NULL as the value of a symbol.
-For example, the symbol value may be the result of
+There are several scenarios when the address of a global symbol is NULL.
+For example, a symbol can be placed at zero address by the linker, via
+a linker script or with
+.I --defsym
+command-line option. Undefined weak symbols also have NULL value.
+Finally, the symbol value may be the result of
 a GNU indirect function (IFUNC) resolver function that returns
-NULL as the resolved value.
+NULL as the resolved value. In the latter case,
+.BR dlsym ()
+also returns NULL without error. However, in the former two cases, the
+behavior of GNU dynamic linker is inconsistent: relocation processing
+succeeds and the symbol can be observed to have NULL value, but
+.BR dlsym ()
+fails and
+.BR dlerror ()
+indicates a lookup error.
 .\"
 .SS History
 The