Stuck codes in samples from ADC
Interesting.
I don't think I've ever seen this anomaly before.

It's often convenient to think of a SAR ADC as if it samples the input analog voltage at some instant in time.
In practice, there is a narrow window of time where changes in the input analog voltage --
or noise on the analog voltage reference, or noise on the GND or other power pins of the ADC --
can affect the output digital value.

If the input voltage is slowly rising during that window, then the less-significant bits of the SAR output will be all-ones.

If the input voltage is slowly falling during that window, then the less-significant bits of the SAR output will be all-zeros.

A very narrow noise pulse at the "wrong" time during conversion can have a similar effect.

Right now my best guess is that you're using some sort of analog switches or op amps that don't work quite as well (higher resistance or something) near the high and low power rails as they do near mid-scale, somehow letting in one of the above kinds of noise, which causes the less-significant bits to be all-ones or all-zeros.

I've seen some sigma-delta ADCs and sigma-delta DACs that have good resolution at mid-scale, but worse resolution near the rails -- but the effect looks different than what you show.

The "plot of the difference between one sample and the next sample over the entire full scale range" is fascinating.

If I were you, I would make a similar plot that, instead making the X value the difference between one sample and the next, make the X value the least-significant 6 bits of the raw ADC output sample.
That would quickly show if the "stuck" values are mostly lots of 1s in the least-significant bits (maybe input is slowly rising?) or lots of 0s in the least-significant bits (maybe input is slowly falling?).


  I am sampling "pulsed" DC voltages. That means that for each
  measurement I put a voltage on the DAC, let it settle for at least 100
  times it's settle time, then tell the ADC to convert - and when
  conversion is finished, I put the DAC back to 0 V.


My understanding is that when ADC manufacturers say "no missing codes",
the test they use involves several capacitors adding up to a huge capacitance directly connected to the ADC input,
and some system driving a large resistor connected to that capacitance that very slowly charged or discharged that capacitor,
slowly enough that the ADC is expected to see exactly "the same" voltage (within 1/2 LSB) for several conversion cycles before it sees "the next" voltage (incremented by 1 going up, decremented by 1 going down).

If I were you, I would see if such a "continuous slope" test gives the same weird "stuck code" symptoms as the "pulsed test".
Perhaps that would give more clues as to exactly what component(s) are causing this problem.

Please tell us if you ever figure out what caused these symptoms.