Fix implementation nullness guarantees