+blk_status_t null_handle_badblocks(struct nullb_cmd *cmd,
+				   sector_t sector, sector_t nr_sectors);
+blk_status_t null_handle_memory_backed(struct nullb_cmd *cmd, enum req_opf op);
+
+static inline blk_status_t null_process_cmd(struct nullb_cmd *cmd,
+					    enum req_opf op, sector_t sector,
+					    unsigned int nr_sectors)
+{
+	struct nullb_device *dev = cmd->nq->dev;
+	blk_status_t ret;
+
+	if (dev->badblocks.shift != -1) {
+		ret = null_handle_badblocks(cmd, sector, nr_sectors);
+		if (ret != BLK_STS_OK)
+			return ret;
+	}
+
+	if (dev->memory_backed)
+		return null_handle_memory_backed(cmd, op);
+
+	return BLK_STS_OK;

I think this should remaing non-inlined in null_blk_main.c.

+blk_status_t null_handle_memory_backed(struct nullb_cmd *cmd, enum req_opf op)
 {
 	struct nullb_device *dev = cmd->nq->dev;
 	int err;
 
+	if (!dev->memory_backed)
+		return BLK_STS_OK;

Why does this duplicate the check done in the caller?

+	if (dev->zoned) {
+		cmd->error = null_handle_zoned(cmd, op, sector, nr_sectors);
+		goto out;
 	}
 
+	cmd->error = null_process_cmd(cmd, op, sector, nr_sectors);

Why not:

	if (dev->zoned)
		cmd->error = null_handle_zoned(cmd, op, sector, nr_sectors);
	else
		cmd->error = null_process_cmd(cmd, op, sector, nr_sectors);

And maybe rename null_handle_zoned to null_process_zoned_cmd to keep
things symmetric.