tun_format is supposed to return a buffer allocated by malloc()