There seems to be an extra level of indirection when string variables are passed, and a strange offset of one byte.
This works for me (under WinAPE):
org &4000
limit &4fff
ld e,(ix+0)
ld d,(ix+1)
inc de
ld a,(de)
ld l,a
inc de
ld a,(de)
ld h,a
push hl
pop iy
ld a,(iy+0)
call &bb5a ;'h'
ld a,(iy+1)
call &bb5a ;'o'
ld a,(iy+2)
call &bb5a ;'b'
ret
I have to INC the address in IX by one byte, and read the two bytes at that location as another address - the address of my string!? Contrast this with passing in numeic vars (%), where IX is the actual address of that variable in memory.
I know C, so the address of a string being a ptr to a ptr doesn't surpise me, but I do not understand IX being one byte out ...