CFMutableData doesn’t hide its internal storage after all
From the 2005-12-06 definition of CFDataGetMutableBytePtr:
This function either returns the requested pointer immediately, with no memory allocations and no copying, or it returns NULL. If the latter is the result, call the CFDataGetBytes function to copy the byte contents to an external buffer. Note that if you subsequently call any mutating function on theData—including operations that may not appear to change the length of the data—this may invalidate the pointer.
Whether this function returns a valid pointer or NULL depends on many factors, all of which depend on how the object was created. In addition, the function result might change between different releases and on different platforms. So do not count on receiving a non-NULL result from this function under any circumstances.
From the 2007-02-08 definition of CFDataGetMutableBytePtr:
This function is guaranteed to return a pointer to a CFMutableData object’s internal bytes. CFData, unlike CFString, does not hide its internal storage.
Good to know.