Here is a list of APIs using List that may use mutable list, by comprehensive search:

AttributedElement.findAttributes
ClassFile.verify - mutable for full verified results
ClassSignature.typeParameters - missing copy on record ctor
CompoundElement.elementList - mutable for buffered models
RuntimeInvisibleParameterAnnotationsAttribute(and Visible) - can nest mutable list
StackMapFrameInfo.locals/stack - public factory missing coppy

We can check if we want strict null hostility or just immutability (so unmodifiableList is ok).

unmodifiable vs null-hostile:
Signature record creation - parsing from string is not null hostile
BoundAttribute.readAttributes - not null hostile
CodeImpl.exceptionTable - not null hostile
TableSwitchInstruction bound cases - not null hostile
Util.mappedList - not null hostile