I think it's an auto-antonym, i.e. divide opcodes into three sets: 1. Documented 2. Undocumented and throws #UD 3. Undocumented but does not throw #UD

I think it's an auto-antonym, i.e. divide opcodes into three sets: 1. Documented 2. Undocumented and throws #UD 3. Undocumented but does not throw #UD Some people will use "Illegal instruction" to refer exclusively to (2), some as exclusively to (3), and some as both (2) and (3). Edit: Interesting to see https://github.com/xoreaxeaxeax/sandsifter/tree/dff63246#flags https://github.com/xoreaxeaxeax/sandsifter/tree/dff63246#fla... for how the author of Sandsifter describes the --ill option: > --ill - the inverse of --unk, search for invalid disassemblies (instructions that do not successfully execute but that the disassembler acknowledges) If we assume "disassembler acknowledges" is approximately equivalent to "documented", then --ill is actually looking for a subset of (1): "Documented but throws #UD"...which also seems fairly natural, at least in this context.