Change

foo = POINTER(temp_foo)

to

foo = pointer(temp_foo)

can solve the problem.

Please see http://docs.python.org/library/ctypes.html#ctypes-pointers for more information.

Here's a working example. It looks like you are passing the wrong type to the function and the structure was declared incorrectly for the Data member. Note below how to declare the type of a fixed-size array when declaring the Python structure.

test.c ("cl /W4 /LD .c" on Windows):

#include <stdio.h>

#ifdef _WIN32
#   define SMBUS_API __declspec(dllexport)
#else
#   define SMBUS_API
#endif

#define SMB_MAX_DATA_SIZE 5

typedef void* SMBUS_HANDLE;

typedef struct _SMB_REQUEST {
    unsigned char Address;
    unsigned char Command;
    unsigned char BlockLength;
    unsigned char Data[SMB_MAX_DATA_SIZE];
} SMB_REQUEST;

SMBUS_API int SmBusReadByte(SMBUS_HANDLE handle, SMB_REQUEST *request) {
    for(unsigned char i = 0; i < request->BlockLength; ++i)
        request->Data[i] = i;
    return request->BlockLength;
}

SMBUS_API SMBUS_HANDLE OpenSmbus(void) {
    return (void*)0x12345678;
}

test.py:

import ctypes as ct

SMB_MAX_DATA_SIZE = 5
ARRAY = ct.c_ubyte * SMB_MAX_DATA_SIZE

class SMB_REQUEST(ct.Structure):
    _fields_ = (('Address', ct.c_ubyte),
                ('Command', ct.c_ubyte),
                ('BlockLength', ct.c_ubyte),
                ('Data', ARRAY))

dll = ct.CDLL('./test')
smbus_read_byte = dll.SmBusReadByte
smbus_read_byte.argtypes = ct.c_void_p, ct.POINTER(SMB_REQUEST)
smbus_read_byte.restype = ct.c_int
open_smbus = dll.OpenSmbus
open_smbus.argtypes = ()
open_smbus.restype = ct.c_void_p

handle = open_smbus()
print(f'{handle = :08X}h')

smb_request = SMB_REQUEST(1, 2, 5)

print(f'returned = {smbus_read_byte(handle, smb_request)}')
print(f'Address = {smb_request.Address}')
print(f'Command = {smb_request.Command}')
print(f'BlockLength = {smb_request.BlockLength}')
for i, b in enumerate(smb_request.Data):
    print(f'Data[{i}] = {b:02X}h')

Output:

handle = 12345678h
returned = 5
Address = 1
Command = 2
BlockLength = 5
Data[0] = 00h
Data[1] = 01h
Data[2] = 02h
Data[3] = 03h
Data[4] = 04h

Your definition of PicamCameraID structure is incorrect: sensor_name and serial_number are arrays:

"""
struct PicamCameraID {
  PicamModel             model;
  PicamComputerInterface computer_interface;
  pichar                 sensor_name[PicamStringSize_SensorName];
  pichar                 serial_number[PicamStringSize_SerialNumber]; 
};
"""
import ctypes as c

PicamStringSize_SensorName = PicamStringSize_SerialNumber = 64
PicamModel = PicamComputerInterface = c.c_int
pichar = c.c_char

class PicamCameraID(c.Structure):
    _fields_ = [("model", PicamModel),
                ("computer_interface", PicamComputerInterface),
                ("sensor_name", pichar * PicamStringSize_SensorName),
                ("serial_number", pichar * PicamStringSize_SerialNumber)]

It seems the second argument is just a string, so you don't need to apply pointer() to it. Here's the ctypes prototype for Picam_ConnectDemoCamera() function:

"""
Picam_ConnectDemoCamera(PicamModel model, const pichar* serial_number,
                        PicamCameraID* id)
"""
pichar_p = c.c_char_p # assume '\0'-terminated C strings
Picam_ConnectDemoCamera.argtypes = [PicamModel, pichar_p,
                                    c.POINTER(PicamCameraID)]
Picam_ConnectDemoCamera.restype = c.c_int # assume it returns C int

To call it:

picam_id = PicamCameraID()
rc = Picam_ConnectDemoCamera(2, "serial number here", c.byref(picam_id))
print(rc)
print(picam_id.sensor_name.value) # C string
print(picam_id.sensor_name.raw)   # raw memory

The usual reason for problems with ctypes is not defining .argtypes and .restype for the functions being called. In particular, the return type defaults to an c_int (typically 32-bit) and on a 64-bit system your function would return a 64-bit pointer.

import ctypes as c

class LIB_OPTIONS(c.Structure):
    """Struct containing the available options for the library"""
    _fields_ = [('ip', c.c_char * 255),
                ('bufsize_MB', c.c_int)]

c_lib = c.CDLL('./test')
c_lib.lib_internal_obj_new.argtypes = c.POINTER(LIB_OPTIONS), # 1-tuple declaring input parameter
c_lib.lib_internal_obj_new.restype = c.c_void_p # generic pointer

lib_opts = LIB_OPTIONS(b'192.168.1.1',2)
lib_object = c_lib.lib_internal_obj_new(c.byref(lib_opts))

Here's a way...

The class variable Test._fields_ defines the attributes and their C types. The class attributes generated by assigning the fields contain information about the offset for that attribute, for example:

>>> Test.a
<Field type=c_long, ofs=0, size=4>
>>> Test.b
<Field type=c_double, ofs=8, size=8>
>>> Test.c
<Field type=c_char_Array_10, ofs=16, size=10>

For each type, the from_buffer() method builds a C type using the same data buffer as an existing type. An instance of the structure implements the buffer API required to access its data, so if you know the offset of a structure element's data, you can generate a ctypes type that references the same data, and create a pointer to it.

from ctypes import *

class Test(Structure):
    _fields_ = [('a',c_int),
                ('b',c_double),
                ('c',c_char * 10)]

x = Test(1,2.5,b'abc')

for field,ftype in Test._fields_:

    # Look up each attribute in the class, and get its offset.
    ofs = getattr(Test,field).offset

    # Create a pointer to the same field type using the same data.
    p = pointer(ftype.from_buffer(x,ofs))
    print(p,p.contents)

Output:

<__main__.LP_c_long object at 0x000001932DE0EEC8> c_long(1)
<__main__.LP_c_double object at 0x000001932DE0ECC8> c_double(2.5)
<__main__.LP_c_char_Array_10 object at 0x000001932DE0EDC8> <__main__.c_char_Array_10 object at 0x000001932DE0ECC8>

The problem is that the higher level "POINTER" from ctypes is, in Python, a different object than "a generic pointer" (ctypes.CArgObject by ctypes.byref)which is returned or a single number representing a memory address (which is what is returned by ctype's adrresof) - you can either annotate your function to receive a `ctypes.c_voidp and call it with _lib.mymethod(ctypes.addressof(a)) instead -

Or if you want to work on the stronged-typed side to avoid errors that would crash Python (a type error raises a Python exception instead - a wrong parameter passed to a C unction would cause a segmentation fault on the Python interpreter itself), you have to create a variable to hold the new "type" which is a POINTER to your structure - and then create an instance of this type with the address of your structure:

mystruct_pointer = ctypes.POINTER(mystruct)
_lib.mymethod.argtypes = (mystruct_pointer,)
_lib.mymethod.restype = ctypes.c_int

s = mystruct()

_lib.mymethod(mystruct_pointer.from_address(ctypes.addressof(s)))

I think what you may be missing is knowing exactly where you want the struct memory to be allocated. The c code below provides a function that allocates memory for the struct and returns a pointer to it (new_struct()).

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct {
    int a;
    int b;
} my_struct;

my_struct *new_struct()
{
    my_struct *struct_instance = (my_struct *)malloc(sizeof(my_struct));
    memset(struct_instance, 0, sizeof(my_struct));
    return struct_instance;
}

int modify_struct(my_struct *ms) {
    ms->a = 1;
    ms->b = 2;
    return 0;
}

void print_struct_c(my_struct *ms) {
    printf("my_struct {\n"
           "    a = %d\n"
           "    b = %d\n"
           "}\n", ms->a, ms->b);
}

From Python, to get the pointer, call the C function that does the allocation, then you can pass that to the other C functions that take it as a parameter.

import ctypes

lib_file_path = <<< path to lib file >>>

# Very simple example of how to declare a ctypes structure to twin the
# C library's declaration. This doesn't need to be declared if the Python
# code isn't going to need access to the struct's data members.
class MyStruct(ctypes.Structure):
    _fields_ = [('a', ctypes.c_int),
                ('b', ctypes.c_int)]

def print_struct(s):
    # Print struct that was allocated via Python ctypes.
    print("my_struct.a = %d, my_struct.b = %d" % (s.a, s.b))

def print_struct_ptr(sptr):
    # Print pointer to struct. Note the data members of the pointer are 
    # accessed via 'contents'.
    print("my_struct_ptr.contents.a = %d, my_struct_ptr.contents.b = %d" 
          % (sptr.contents.a, sptr.contents.b))


my_c_lib = ctypes.cdll.LoadLibrary(lib_file_path)

# If you don't need to access the struct's data members from Python, then 
# it's not necessary to declare MyStruct above. Also, in that case,
# 'restype' and 'argtypes' (below) can be set to ctypes.c_void_p instead.
my_c_lib.new_struct.restype     =  ctypes.POINTER(MyStruct)
my_c_lib.modify_struct.argtypes = [ctypes.POINTER(MyStruct)]

# Call C function to create struct instance.
my_struct_c_ptr = my_c_lib.new_struct()
print_struct_ptr(my_struct_c_ptr)

my_c_lib.modify_struct(my_struct_c_ptr)
print_struct_ptr(my_struct_c_ptr)

# Allocating struct instance from Python, then passing to C function.
my_struct_py = MyStruct(0, 0)
print_struct(my_struct_py)

my_c_lib.modify_struct(ctypes.byref(my_struct_py))
print_struct(my_struct_py)

# Data members of Python allocated struct can be acessed directly.
my_struct_py.a = 555

my_c_lib.print_struct_c(ctypes.byref(my_struct_py)) # Note use of 'byref()'
                                                    # to invoke c function.

The code above has been updated to include an example of how to allocate a struct instance via Python, and how to access the data members of either the C allocated or Python allocated struct (note differences in the print functions).

You are assuming that c directly follows b which is not the case. The compiler will pad a few bytes, 2 on x86, in that structure to align c.

The proper way is to declare one-to-one mapping of your structure in ctypes:

from ctypes import *

class object_t(Structure):
    _fields_ = [
        ('a', c_uint8),
        ('b', c_uint8),
        ('c', c_uint32),
        ('d', POINTER(c_uint8)),
    ]

No you can obtain the value of any member thought this type.

C example library:

#include <stdint.h>
#include <stdlib.h>

struct object_t {
  uint8_t a;
  uint8_t b;
  uint32_t c;
  uint8_t* d;
};

static struct object_t object = {'a', 'b', 12345, NULL};

struct object_t * func1(void)
{
  return &object;
}

void func2(void(*callback)(struct object_t *))
{
  callback(&object);
}

Using it from Python:

from ctypes import *

class object_t(Structure):
    _fields_ = [
        ('a', c_uint8),
        ('b', c_uint8),
        ('c', c_uint32),
        ('d', POINTER(c_uint8)),
    ]

callback_t = CFUNCTYPE(None, POINTER(object_t))

lib = CDLL('./file.dll')

func1 = lib.func1
func1.argtypes = None
func1.restype  = POINTER(object_t)

func2 = lib.func2
func2.argtypes = [callback_t]
func2.restype   = None

ret = func1()

a = ret.contents.a
b = ret.contents.b
c = ret.contents.c
d = ret.contents.d

def mycallback(obj):
    a = obj.contents.a
    b = obj.contents.b
    c = obj.contents.c
    d = obj.contents.d

func2(callback_t(mycallback))

You have at least four problems here (actually, five, but one isn't relevant).

The line that was (usually) causing your segfault is this:

varsdb = ct.cast(varsd, returnStruct_t)

This is because you're trying to cast a void * to a returnStruct_t, rather than to a returnStruct_t *. Since a returnStruct_t is much larger than a pointer, there's a good chance this will run off the end of an allocated page. Even if it doesn't segfault, it's giving you garbage values. It's equivalent to this C code:

returnStruct_t varsdb = *(returnStruct_t *)(&varsd);

What you wanted was the equivalent of:

returnStruct_t *varsdb = (returnStruct_t *)(varsd);

In other words:

varsdb = ct.cast(varsd, returnStructPointer)

After fixing that, I often, but not always, still get a segfault later, on trying to access varsdb.contents.vars[0].x[0][0] (varsdb.contents.vars[0].x[0] itself is always safe).

The next problem is that you haven't defined your struct properly. Here's the C:

typedef struct testStruct {
  double *x[11];
  double *u[10];
} Test;

And here's the Python:

class vars_t(ct.Structure):
    _fields_ = [("u", ct.POINTER(ct.c_double*10)),
                    ("x", ct.POINTER(ct.c_double*11))]

You've mixed up u and x. So, what you're calling x, and treating as an array of 11 doubles, is actually u, an array of 10 doubles. So every time you touch x[10], you're going past the end of the array.

After fixing that one too, I get garbage values printed out. With the clang build, it's always close to 6.92987533417e-310.

I think this one is purely in the C code. I often get garbage numbers printed out from those x[10][4] and u[9][2] lines in C. Again, with the same build, I get about an equal mix of reasonable values, numbers like 26815615859885194199148049996411692254958731641184786755447122887443528060147093953603748596333806855380063716372972101707507765623893139892867298012168192.000000 for both, and reasonable values for the former but nan for the latter.

And when I run a simple C driver under valgrind, every fourth fprintf I get this:

==85323== Use of uninitialised value of size 8

So you've presumably got an off-by-one error in your allocation or initialization code in C, and you sometimes but not always get away with it.

Also, these aren't the same type:

typedef struct returnStruct_t {
  Test* vars;
} ReturnStruct;

class returnStruct_t(ct.Structure):
    _fields_ = [("vars", vars_t*numOpt)]

The former is a single pointer long, and that pointer points at an array of Test objects. The latter is 3 Test objects. So, once again, you're trying to read a pointer to something as a value of that type, and here you're going way past the end of the allocated value.

After fixing that, I no longer get any crashes, and I get reasonable final values like 80.0 even when I get the garbage printouts along the way. But of course I still get those garbage printouts along the way, and valgrind is still complaining, so obviously this still isn't the last problem.

You've also got an obvious leak in your code—which isn't directly relevant to the problem, but it's a good sign that you've probably got similar errors elsewhere. You allocate the x arrays like this:

for(x = 0; x < 11; x++)
  varsStruct[i].x[x] = (double *)malloc(sizeof(double)*5);    

… then free them like this:

for(x = 1; x < 11; x++) 
  free(returnStruct->vars[i].x[x]);

So x[0] never gets freed.

From documentation:

Pointer instances have a contents attribute which returns the object to which the pointer points

So try:

>>> print ret.contents.a

Be aware that the documentation states:

Note that ctypes does not have OOR (original object return), it constructs a new, equivalent object each time you retrieve an attribute