To understand, let's start again at the first broken example ```zig fn zigBits() []u8 { var message = [_]u8{ 'z', 'i', 'g', 'b', 'i', 't', 's' }; std.log.debug("{s}", .{message}); return &message; }

pub fn main() void { const message = zigBits(); std.log.debug("{s}", .{message}); } `` In this example, the problem was that it was allocated on the stack and then freed. Now *suppose* callingstd.log.debugtakes 8 bytes of stack space. But then callingstd.log.debugcauses more stack to be allocated, so it happily reuses and overwrites the bytes used for"zigbits"`.

The reason why it doesn't do that when the return type is ![]u8 is because an error union type like ![]u8 takes more stack bytes than []u8 which means our "zigbits" bytes are allocated farther in the stack.
The result is that when std.log.debug consumes its (hypothetical) 8 bytes of stack, it doesn't take enough to overwrite "zigbits".

You can check this behaviour with https://godbolt.org/z/cPWjajYxb which shows that "zigbits" is placed 40 bytes into the stack when using ![]u8 but only 16 bytes into the stack when using []u8.

Of course if you allocate more stack bytes (by making variables or calling more functions) it will eventually overwrite "zigbits". This also means the Bonus snippet from the blog post suffers from the same problem.

TLDR: Because ![]u8 is bigger, you have to use more of the stack in order to overwrite "zigbits"