Of course, *_r is a better option, but the existing API is used so pervasively that it needs to be made thread-safe to actually avoid thread-unsafe code in, e.g, libraries.

I don’t see how you can make:

- return a pointer - the library owns the allocation - the state is global and mutable

Thread safe

A number of libc functions return a pointer to an internal thread-local buffer, which is invalidated on subsequent calls. If the function copies the environment variable's value to such a buffer while holding the mutex controlling access to the global state, then the returned value is guaranteed to remain unaffected by other threads.

There are, however, other problems (discussed elsewhere in this thread) that complicate such an API in the context of getenv().

Requiring you to hold a mutex to safely call the function is an API change

I was not suggesting the caller hold a mutex, but rather getenv(), which eould be transparent to the caller.

Don’t you need C++11?