Wouldn’t you wrap the allocation with an alloc/free function that does the allocation with whatever extra bytes that are needed? Letting the API users deal with such details seems a recipe for disaster.