It's annoying that ".internal" isn't one of these, since mDNS uses ".local" by default - I've seen a lot of orgs using that in particular to avoid exactly the mDNS clash.
I decided after much consternation to hijack ".home" for my home network although ".internal" was also in the running. I really wish they hadn't just ignored the actual existing usage of ".local" when they decided to reserve it exclusively for mDNS.
I like the invalid. TLD. Naming things is hard and that's a good one to use when you need to provide a FQDN that serves no actual purpose. Case in point: Amazon CloudFront always requires you to provide an origin, even if you're not sending any traffic to it. So using something like "origin.invalid" makes it just a tad more self-explanatory.
Anywhere you need a domain name that you are sure will never, ever, ever resolve via the root DNS servers at any point in the future.
ICANN fights tooth and nail to eliminate these. As far as they are concerned, every syntactically-valid domain name except .arpa and .example.{com,net,org} is theirs to sell -- even if they choose not to do so at the current moment. RFC9476 is basically the IETF finally getting fed up with ICANN's nonsense.
One concrete example is adding more onion-like namespaces. As long as the name is cryptographically self-certifying, you don't need a central authority to manage it. But it is generally a good idea to use a section of the namespace that the central authority isn't going to simply put up for sale at some point in the future. It's actually in their interest to do this, in order to sabotage competing decentralized protocols. Or they might just talk a lot about doing it, in order to scare people.
For example, I2P has .b32 which is their version of .onion. Tor shouldn't be special; other projects should be allowed to try out new ideas.