ApiQueryGlobalUserInfo::execute returns an error if the guiuser param is an IP address or range:

$username = User::getCanonicalName( $params['user'] );
if ( $username === false ) {
	$this->dieWithError( [ 'apierror-invaliduser', wfEscapeWikiText( $params['user'] ) ] );
}

...since User::getCanonicalName called this way returns false if passed an IP address.

This is not enforced via getAllowedParams, meaning that the normal invalid param error is not encountered, and the documentation incorrectly states that and IP address or CIDR is valid.