! and * might be documented examples, but it also clearly states that anything which is an invalid result of crypt(3) can be used. 'x' fits this criteria. Is there an actual problem here?

It took me quite some researching to figure out what 'x' meant. Stating that anything being an invalid result of crypt(3) is vague and not very helpful. Crypt(3) is very ambiguous on the matter and never mentions anything about 'invalid result'. Only the last part of crypt(3) mentions anything related to it, stating: "The characters in "salt" and "encrypted" are drawn from the set [a-zA-Z0-9./].". The examples given in shadow(5) are very easy to understand and do not require further researching on the internals of the crypt() function.

The only shadow users that have 'x' as their encrypted password is the default ones included from this package. All other users have '!' as their encrypted password if not set. Consistency would be great.

An invalid return from crypt(3) is simply some output that can't possibly be the result of hashing a password. As such, *any* single character, or string with a non-hex digit fulfills this. If you're looking at details at this low level, I think it's easier to understand the concepts rather than the implementation. There's a number of tools which might write to /etc/whatever and I'm not going to be held responsible for making sure they're all doing the same thing. Currently, the userdb files included with filesystem all use 'x' to denote an invalid password. That's as much consistency as you're going to get out of me.