Abstract namespace for Unix domain sockets under Linux

Linux allows an "abstract namespace" for Unix domain sockets, in which sockets do not have to be associated with a path in the filesystem. This was introduced in Linux 2.2.

Processes request the abstract namespace by setting the first byte of sun_path in "struct sockaddr_un" to zero. The rest of the bytes (upto the length passed to bind()/connect()) make up the name. The name is not null-terminated, unlike normal domain socket pathnames.

Unfortunately, this design makes it very difficult to search for uses, because there is no keyword to search for.

I have not found anything explaining why this was introduced.

Questions

Is the name used unchanged?
How is it supposed to be used? Do applications generate a name randomly?
What happens when the application stops listening on the socket? Does the name become available for use again?
Most importantly: What access control is now done? What processes can connect?

Who uses this facility?

strace reports these socket names as path=@... instead of path="...".

DBus: Confusingly, it uses a pathname such as /tmp/XXXX as the abstract name. DBus can be configured to use or not use abstract names with the <listen> setting in /etc/dbus-1/system.conf.