- The caller is expected to `malloc` a region `length + 1` and zero terminate it before handing it in. - This is highly prone to mistake and surprise. - The API should be refactored around what `path_view` does i.e. caller must specify zero termination. - I also think caller should not be calling `malloc` in the first place, that's an internal implementation detail which should not be exposed. - Also what about on Freestanding where there is no `malloc`?