There're 2 problems.
a) The dll does not receive a UNICODE buffer pointer.
It receives an ANSI buffer pointer.
This is why 1) and 2) do not work correctly but 3) works.
Using 'As String' causes VBA to automatically UNICODE-ANSI
conversion.
To solve the problem , there're 2ways.
a1) Do not use 'As String' , use 'ByVal ... As Long' instead.
And pass the variable pointer with varptr undocumented
function.
a2) Stop converting UNICODE-ANSI . Let VBA do that.
b) Maybe, VBA recognises the return value as BSTR not char*.
So VBA tries to SysFreeString the char* pointer incorrectly.
This is why 3) crashes.

I have no time now , I'm sorry I cannot send a sample code here.