This happens both with the full patron entry form and the quick add form. When the cardnumber is required, it's possible to enter either spaces or non-printing characters into the cardnumber field and save the record. That is, there's nothing but whitespace. The value of cardnumber saved in the database in this case is NULL. It would be helpful if Koha verified that the cardnumber field contained something other than whitespace and prevented it from saving if it did not, when the cardnumber is required. I'm not sure if this relates to bug 30978 in any way, but I'm referencing it here just in case.