I noticed that ctools rmdir(1) expects dirname(3) to modify the string in place, but POSIX permits implementations to return pointers to static storage. In particular, OpenBSD's dirname does this. Not sure about others.