danatrader, thanks for your reply. I'm not sure I follow, though. I think you are saying strmid() behaves as designed, right?

"If count exceeds the length of str, it is copied until the end" => That means strmid() returns the entire rest of the string until the end. But that is not the issue here. As you pointed out, count (=2 in each example) is in fact *less* than the length of str.

In my last two examples, what is returned is one resp. two characters *prior* to the one pointed to by first. This is inconsistent with the description in the manual and with strmid()'s behavior in adjacent cases.