Split off legacy/trac#28077: > > from_bytes_with_nul returns an error if there is more than one nul byte in the string. > > ... > > Returning an empty string could be a source of subtle bugs. > Misuse is extremely unlikely to slip in since this is only used on string literals. But yeah, the ideal solution would be statically asserting at compile-time that the passed literal has no NUL bytes in it, so the only one is the byte being appended. > > But defaulting to an empty string(in a case that is basically impossible to get) is the intentional documented behavior of the macro ever since it was first [merged](https://gitweb.torproject.org/tor.git/commit/?h=tor-0.3.4.1-alpha&id=bda1dfb9e0a863ae1ec1230c23ed74837be01a35) in legacy/trac#25185. Improving on that seems like a separate ticket.