Another was a read() system call that would copy into a caller-supplied buffer if it had to, but would normally just return a pointer into its buffer cache.

I know somebody who has some. You sort of need more than one so the token has somewhere to go.