...
If the string returned by getenv() must be altered, a local copy should be created. Altering the string returned by getenv() is undefined behavior. (See undefined behavior 184189.)
Similarly, subclause 7.11.1.1, paragraph 8 [ISO/IEC 9899:2024], defines setlocale() as follows:
...
Altering the string returned by setlocale() or the structure returned by localeconv() are undefined behaviors. (See undefined behaviors 120119 and 121.) Furthermore, the C Standard imposes no requirements on the contents of the string by setlocale(). Consequently, no assumptions can be made as to the string's internal contents or structure.
...
Altering the string returned by strerror() is undefined behavior. (See undefined behavior 184189.)
Noncompliant Code Example (getenv())
...