Sure, but always returning -1 would not satisfy "the behavior is as if the size were some nonzero value", as that would mean two consecutive calls to malloc(0)

Sure, but always returning -1 would not satisfy "the behavior is as if the size were some nonzero value", as that would mean two consecutive calls to malloc(0) would return the same value. Which is not how malloc() with a non-zero size behaves per the previous part of the definition. Writing a specification is hard...