type parameter bounded by SAM might lead to false negative

Command

javac \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED \
  -J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED \
  -J--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED \
-processor org.checkerframework.checker.nullness.NullnessChecker \
-cp ~/projects/checker-framework/checker/dist/checker.jar -Aignorejdkastub Test.java

File

import java.util.function.*;
import org.checkerframework.checker.nullness.qual.*;

class A<T extends Function<Integer, Integer>> {
    T f;
    A(T f) {
        this.f = f;
    }
    T get() { return this.f; }
}

class Test {
    static public void main(String[] args) {
        new A<>(Test::m).get().apply(1).intValue();
    }

    public static <T extends @Nullable Object> T m(T x) { return (T) null; }
}

Actual behavior

There's a NPE at runtime

Exception in thread "main" java.lang.NullPointerException: Cannot invoke "java.lang.Integer.intValue()" because the return value of "java.util.function.Function.apply(Object)" is null
        at Test.main(Test.java:14)

Expected behavior

The code should have been rejected.