good

Why not use recursion?

*dst++ = ' ' means set the character that dst is pointing at to ' ' and then forward the address of dst one character.

What does it mean dst++=...?

It's fun to solve this kata in C and without using loop constructs.

Good one. You just need to free the allocated memory for sx and sy. The caller is responsible for freeing sz - that would be the test suite. In fact, the caller should have allocated the necessary memory for the result too.

There are no 5 loops, or loops in general. Linq is a bunch of enumerators that may accept some things piped in and yields some results one by one. So even if you insist on claiming there are "loops", there's only 1 of them.

But watch out for the classic rookie fallacy - assuming that having one loop where you do five things per iteration is innately superior to having five loops where you do one thing per iteration.

Short, concise and easy to read but, if I'm not mistaken, I see 5 loops here where it could be done in one.