Nice stories. I don't understand how exactly the solution for 'All Signs Point to "No-No"' works. He says he packs the controller id into the pointer slot, allright, but doesn't he also say that the framework will free() the pointer later?
If you had an allocator like this, you could use the addresses 0 through 3, and presumably the deallocator would mask these all down to zero, and then do a check to make sure it doesn't free 0, and end up doing nothing.
You could set the pointer's value to be the controler's ID and then set it to null while you handle the event, and before you pass it down the chain. Or, the OS might be ok (and do nothing) when trying to free memory that's in the middle of a block of allocated memory.