add a gotcha

Returned strings are not null-terminated; this should be noted.