Pun-Pun is a theory-crafted kobold developed in an attempt to have the most powerful character possible at the lowest level possible.
While I'm sure not many DMs would allow Pun-Pun as a PC, can such a creature nonetheless be created using the rules as written?
Yes. It doesn’t even require especially dubious interpretation, just no one deciding enough is enough and putting a stop to it. And the basic combo even fits in a “Core + 1 book” environment—this really doesn’t require a ton of dubious interactions between disparate parts.
The key is the manipulate form ability of sarrukhs from Serpent Kingdoms. Serpent Kingdoms is a Forgotten Realms book, and it only works on a “scaled one” native to Toril, so those are “issues” here, but neither requirement is really a significant hindrance, speaking hypothetically: we can just assume we’re talking about an FR game—which means everyone is presumably native to Toril—, and plenty of PC-eligible races count as “Scaled Ones.”
Anyway, manipulate form allows a sarrukh to raise any stat of a “scaled one of Toril” up to any number less than or equal to their own value in that stat, as well as give that creature “an extraordinary, supernatural, or spell-like ability,” with no listed limitations.
Here, we see three major limitations:
It’s supernatural, which makes it unavailable through many forms of polymorph magic.
It cannot be used on a sarrukh, which means a sarrukh cannot use it on itself.
It cannot increase a stat beyond the sarrukh’s own stats, which means it can’t get arbitrarily large
But these limitations are all trivially obviated:
While most forms of polymorph magic do not allow you to get supernatural abilities, there are plenty that do, e.g. the core 9th-level spell shapechange.
While you cannot use manipulate form on yourself while you are sarrukh, and therefore require a partner, many spellcasters get a familiar, who can be presumed to be absolutely loyal, and shares in your spells. Furthermore, there’s a core familiar option—the viper—that counts as a scaled one.
While the sarrukh is limited to its own scores as a maximum for how high it can pump an ability score, there is no limit on how or why the ability score is what it is. That means the sarrukh can use bonuses to increase their score, and then increase their partner’s score to the same value—as an actual, base value, without any bonuses.
So any scaled one of Toril who has a scaled one familiar (e.g. a viper) and can cast shapechange can share that spell with the familiar, and then for the duration of that spell one can be a sarrukh and the other can be the scaled one subject, and then they can swap. In between, bonuses can be applied to the one in sarrukh form to increase its maximum values, so that when it uses manipulate form it can increase its partners values higher than its own—and its partner will be able to add another increase on their own turn.
For example,
And that’s not even getting into the question of other abilities—on which there isn’t even the limitation of the sarrukh itself having the ability in question. As written, there isn’t even any limitation that the ability be one that actually exists in the written game—though even most theoretical optimizers balk at that—and surely any ability that does exist and Pun-Pun can become familiar with via, say, shapechange, is fair game. But we could easily point out that, ya know, manipulate form is itself a supernatural ability. And there are extraordinary abilities that increase ability scores, so they could just give each other a bunch of those instead of bothering with the swapped belt of giant strength. On some level, the above approach is taking some extremely conservative interpretations of manipulate form, as absurd as that is.
Anyway, none of this is at all dubious from the perspective of the rules as written. All of it is completely straightforward applications of manipulate form, just used by a coordinated pair of creatures who, together, can work around its few limitations. Serpent Kingdoms was a notoriously poorly-considered book; the sarrukh and its manipulate form are far from the only absurdities in it (though it is by-far the worst of them). Earlier I said that the main limitation on manipulate form was that the sarrukh could not use it on themselves, but that’s not really accurate. The apparent thing the authors expected to prevent this nonsense is the fact that the sarrukh is an unplayable monster. As they so often did, they neglected to consider the possibility of a player getting access to monster abilities, i.e. manipulate form.
Now, various approaches to Pun-Pun do involve more tricks to allow you to pull the combo at lower and lower levels, and to get more abilities that might otherwise be inaccessible (e.g. class features that no monster has, or abilities that were defined but never given to any creature or class, or abilities that are just made up on the spot), and so on. Some of those tricks are somewhat more dubious, RAW-wise, than the basic combo.
One of the most famous renditions of Pun-Pun (the first one to work at 1st level) involves Pun-Pun as a kobold paladin who gets a wish off the demon prince Pazuzu, because you see, the description of Pazuzu says that the first wish makes someone Chaotic, and the second wish makes them Evil. Because Pazuzu delights in pulling down paladins, he always endeavors to give paladins everything they want with the first wish, to make it all go perfectly well for them, to try to encourage that second wish. One wish is all that Pun-Pun needs to get the combo going, though, and so the advantage here is you get one absolutely-untwisted wish. But this relies on an NPC description being absolutely iron-clad, on Pazuzu actually being a thing in your setting, and also on a 1st-level paladin knowing about this. People have some quibbles with some or all of that. But other ways of accomplishing 1st-level Pun-Pun, no Pazuzu needed, have been found since then. Even if you disallow all of those, if nothing else, a 17th-level character can just cast shapechange themselves, no wish required.
(For my money, though, Pun-Pun will always be a 1st-level kobold ex-paladin.)
So yeah, one way or another, Pun-Pun is 100% RAW-legal. It’s a fun little testament to the absurdity of the game, an occasionally-useful trivial answer to optimization questions (to illustrate the need for boundaries and constraints on the question), and possibly a challenging problem to work, to optimize it more and get the combo faster or more safely.
Pun-Pun is not playable. No one involved in figuring the combo out has ever recommended playing. In fact, I strongly doubt anyone ever has; it’s just pointless. Once you have achieved Pun-Pun ascension, you can literally do anything you want, with guaranteed success, with absolutely no concern for rules like turns or actions or resources. So even if it does happen it’s kind of like “OK, that’s cute; we’re going to ignore that you did that, and keep playing our game now, because we really don’t appreciate you summarily ending it on us like that.”
Short answer: No, Pun-Pun is illegal.
Long answer: Pun-Pun is created by stacking Sarrukh's(Serpent Kingdoms, p. 80) Manipulate form(Su)-ability X times to get Y abilities looping them through the viper Familiar. The problem with this build is that each of them is a magical effect(Su, as in supernatural = magical) coming from the same source (Pun-Pun's viper familiar).
PHB, p. 171-172(Section: Combining Magical Effects) Speaks about "spells or magical effects", of which kind Manipulate form absolutely is. The rest of the entries speak of spells, but title of each section speaks of "effects", which implies that "spells" in the following text is shorthand for "spells or magical effects". With that clarification, the section: "Same effect with differing results" says: "the last spell in the series trumps the others. None of the previous spells are actually removed or dispelled, but their effects become irrelevant while the final spell in the series lasts."
Finally, the section "Instantaneous effects" says that instant effects are allowed to have cumulative effects. However, the duration of of Manipulate form is not instantaneous, but "permanent"(Serpent Kingdoms, p. 81). Therefore various uses of Manipulate form do not have a cumulative effects with each other.
Pun-Pun could use this method to give himself an arbitrarily high Str, becoming the strongest strongman ever, but as soon as he tried to gain another ability, the increased Str would disappear, replaced by the new ability, whatever it may be. Even if Pun-Pun could get multiple Viper familiars, each having its own Manipulate form, it would not work because the source of each ability gained would be: Manipulate form(Su). Therefore: no stacking.
Also note: Many of these broken builds or broken tricks (like caster level loops or Divine metamagic + a bag of nightsticks) are really just about stacking a single magical effect from the same source in full disregard of rules about magical effects expressly prohibiting it. Everyone in D&D circles remembers that modifiers of same type don't stack, but never the other half of the same sentence that effects from the same source don't stack either. Also look PHB, p. 313 about stacking modifiers, which also forbids stacking from same source, modifiers to rolls in that case. There is no need to houserule Pun-Pun or bag of nightsticks away, just use PHB, p. 172 and remember that they are all magical effects. PHB, p. 313 no-stacking-from-same-source rule also works with non-magical shenanigans.
