Where did you read that freeing is not allowed? What happens if a group contains a really large list of members? Does the implementation have a sufficiently large buffer for any number of members from the start or does it keep all old buffers if a larger buffer is needed?

I would, with the argument that `toStringz()` is the unsafe function that could actually overrun the buffer, agree that simple overwriting can be seen as safe, but still with doubts that `@trusted` really buys anything here apart from the awkward encouragement to use the non-thread-safe functions. Missing thread safety alone (in the sense that the internal buffer is possibly implicitly shared among threads) would be enough reason for me to deem a functon not `@safe`, but maybe I'm alone with this.