>>The string passed in VFP is a 32-bit pointer to a fixed-length array of char, whose exact length is LEN(string variable state when passed). <
>
>If you pass this 4 byte pointer to a function in DLL and that function changes the string value and/or length withour moving it in the memory, then VFP can receive back the value for this string. How VFP moves the string later doesn't matter. Otherwise what is the meaning of passing variables by reference if they cannot be altered?

You can alter the content, not the length. You cannot count on the location in memory remaining the same, so self-referential absolute pointers will become invalid. There are approaches to get around this; one is my ClsHeap class. Rent a clue - download it and read the code.