Send an address only packet (smbus uses these) Just try. Now do it to an address that doesn't ack. Enjoy your wedged i2c state machine.
I’ve recently used the “HAL_I2C_IsDeviceReady” function to scan the whole address range to find devices on the bus with no issues. I’m not near my PC to double check but I’m pretty sure that does what you’re talking about and seems to work ok for me - unless you’re suggesting it’s intermittent?
I think it's worth noting that there are multiple I2C peripherals by ST -- one for STM32F1, F4, and L1; and a different one used for STM32F0, F3, F7, L0, and L4.