Things to note:
-- it doesn't say offset can be NULL
-- it says "Sendfile does not modify the current file pointer of in_fd, but does for out_fd."
Well, turns out offset can be NULL (Linux 2.6.5, fs/read_write.c:638, sys_sendfile) and the in_fd is moved (*ppos = ... ; Linux 2.6.5, mm/filemap.c:725).
So on one hand I'm disappointed in crappy docs, but at least the source is available. *shrug?*