They can contain any octet except ASCII NUL and /.

That said, pretty much every filesystem's on-disk format has an explicit length field for file names. So in theory, there's nothing stopping them from supporting completely binary filenames - it's the kernel's VFS layer that treats NUL and / as special.

D:

And nulls :)

How exactly can they contain nulls?

fopen() takes a null-terminated filename, so if there is a null byte in the middle it would just truncate the filename.

that might be a corrupt filename that can be opened only by its inode in debugfs or similar.

No they can’t.