Yesterday I learned three things:
1) a multichanel ADC has a source for offset errors that I didn't realize before. When you look into my circuit diagram, you'll see that the MOSFET voltage measurement (OUT-) has a 10k filter resistance. According to the STM32's datasheet, that would be enough to settle to <1LSB at full speed. But I measured ~50mV at the ADC input, even with the MOSFETs shorted. Where did that come from? The ADC appnotes from ST didn't give a hint either. It took me half of the evening to figure out that this is charge injection from the previous conversion. The ADC configuration is to continuously convert all five available channels one after another. Therefore it has a MUX that connects one of the sources to the ADC input. That input has a capacitance. If, as in my case, the channel that precedes my problematic one has a siginifcantly higher voltage level, then the ADC input capacitor is charged to that level when switching to that channel. This dumps the stored from energy that capacitor out of the channel's GPIO, into the source network. As this is done repeatedly, this causes a constant current flow. The ADC input capacitance is 8pF, and the conversion rate is approx 100kHz. Assuming the adjacent channel sees 3.3V, and my problematic one has 0V, the current calculates to 100k * 0.5 * 3.3^2 * 8p = 4.3uA. The voltage drop on the 10k resistor then calculates to 43mV. Gotcha!
2) a buck converter with bootstrapped power switch driver can never live with an output capacitor (in my case 2200uF) that 'survives' zero input power longer than the bootstrap capacitor. When the input voltage comes back, then there is nothing that can charge the bootstrap capacitor (as the output almost equals the input). This situation is only resolved when the output voltage has dropped far enough for a restart, unluckily leaving the supplied circuit dead during that time... Solution: move the freewheeling diode from the input to the output of the regulator. Luckily I can do that because I do not need a precise voltage.
3) the ADC inputs of the STM32 are not 5V tolerant. If I would have noticed that earlier, then I would not have to replace a dead microcontroller now. As I need a low leakage input protection, and a zener diode just doesn't deliver on that, I ordered some TL431. They will protect the OUT- input from high voltages.
Luckily the microcontroller did not die before allowing me to make this measurement. (Yellow: voltage across ~700uOhm of AWG8 wire, blue: voltage across MOSFETs) I don't believe the readings yet (why does blue approach zero??), but it suggests that the pulse current (here, into a 100% short circuit) is in the order of 1.5kA. Scary.