> no & appears in the function.
It's an array, so you don't need & to take its address, it decays into a pointer without &.
Imagine:
char buf[sizeof(struct Header) + sizeof(struct T)];
char *p = buf;
Then take away the names so that you are effectively passing p as a parameter... Then returning p.
As in, an anonymous temporary being given to the function, and the function returns its address back.
It's assuming that this temporary parameter buffer will exist after it is used and the function has returned. I'm not sure what the standard says for that but it is crazy sketchy. [Edit: Googling around, it seems like maybe this is illegal in C99 but possibly legal in C11? Or that C11 changed the rules for this. Does not seem like a great thing to rely upon.]