Several SB API functions return strings a (char*, size_t) pair. During capture, we serialize an empty string for the char* because the memory can be uninitialized. During replay, we have custom replay redirects that ensure that we don't override the buffer from which we're reading, but rather a buffer on the heap with the given length. This is sufficient for the "regular" reproducer use case, where we only care about the side effects of the API calls, not the actual return values.
This is not sufficient for passive replay. For passive replay, we ignore all the incoming arguments, and re-execute the current function with the arguments serialized in the reproducer. This means that these function will update the deserialized copy of the arguments, rather than whatever was passed in by the SWIG wrapper. To solve this problem, I've extended the reproducer instrumentation with special case replayers and corresponding macros. They ignore the replayer in the registry and the incoming char pointer, and instead reinvoke the current method on the deserialized class, and populate the output argument. It's unfortunate that this needs to be special cased, but I don't see a better solution.