This is a more general problem. Raised with details above.

hard to approve if the test cases are a black box

indeed! thank you for pointing out this issue!

checkout this solution, it should work with the case you specified!

https://www.codewars.com/kata/reviews/57cb045535ef62f92d0000f1/groups/6124fff7363c66000153b454

thank you again!

You are absolutely correct and I'm a little bit ashamed that I didn't see that.
Thank you very much!

In C code I see out in the wild this is common:

size_t str1_length = strlen(str1);
char *str2 = malloc(str1_length >= 2? str1_length - 1 : 0);
remove_char(str2, some_str);

As long as it's not an explicit requirement that the first argument is a pointer to a null-terminated string the caller can pass a pointer to some object that's large enough to hold the result, e.g. some uninitialized memory.

Yes, that's correct. Other possible problems are if any the pointers is invalid.
But that's not uncommon in C. Take strcpy(dst, src) for example. If dst is too small or any of the pointers is invalid the behavior is undefined.

IMHO calling strlen(src) is not an option because that might not point to a null-terminated string but to some uninitialized memory.

added

damn it... Why wasn't that in the description... x/