After a lifetime of being humiliated by the static analyzer, it has a false positive and I am vindicated.

main.m

#import <Foundation/Foundation.h>

void doSomething(id obj) __attribute__((nonnull(1)));

void doSomething(id obj)
{
    NSLog(@"%@", obj);
}

int main(int argc, const char * argv[])
{

    @autoreleasepool {
        NSArray *list = @[@"a", @"b", @"c", @"d", [NSNull null]];
        __block id match = nil;
        BOOL (^listContainsNull)() = ^{
            for (id item in list) {
                if (item == [NSNull null]) {
                    return YES;
                }
            }
            return NO;
        };
        
        while (listContainsNull()) {
            for (id item in list) {
                if (item == [NSNull null]) {
                    match = item;
                }
            }
            
            doSomething(match); // Analyzer: Null pointer passed as an argument to a 'nonnull' parameter
        }
    }
    return 0;
}

That said, putting an NSAssert above the call to doSomething resolves the issue reported by the analyzer and adds value to the code by making its assumptions more explicit. More robust code == better code!