I think that if fog is disabled, we should be getting corresponding values from vertex processing. Also, at least for the vertex shader case we already clamp fog values in the vertex shader, so unless fixed function can pass us values outside [0,1] we probably can get away with not clamping at all.
Good question.
With the precalculated No-Fog fog I pass values from [255,0] in the vertex attribs. GL fogstart = 255, end = 0, but that is bypassed with pixel shaders.
Otherwise the Z value is used, which can be in any range. So yes, I think the fixed function pipeline can pass any range in. Also we should check how table fog really behaves with shaders.