> The stats themselves look fine to me; I think there must be a
> mathematical error in what selfuncs.c is doing with them.
> Still looking to find it...
Oh, I see it: range selectivity double-excludes NULLs. See the comment
for clauselist_selectivity in src/backend/optimizer/path/clausesel.c.
The individual estimates for the two component comparison operators
each exclude nulls, and when we merge them together we get the wrong
answer.
Good catch! (Though I'm surprised no one noticed this before; with a
larger null population the error would be much more obvious.)
I'm running out of time today but will look into a fix later.
regards, tom lane