Why is my BASH_FUNC_foobar%% environment variable unset in shell subprocesses?

I’m messing around with the security of a setuid binary (with the intention of disclosing anything I find to the author, obviously). I’m pretty sure it has an arbitrary code execution vulnerability because it invokes a shell script and it doesn’t sanitize the environment – I thought of bash’s export -f but I can’t actually make a proof of concept work.

What is causing my “Unexpected EOF Error while looking for …” error?

The command field (the rest of the line) is the command to be run. The
entire command portion of the line, up to a newline or % character, will
be executed by /bin/sh or by the shell specified in the SHELL variable of
the crontab. Percent signs (%) in the command, unless escaped with a
backslash (), will be changed into newline characters, and all data
after the first % will be sent to the command as standard input.

Split single string into character array using ONLY bash

I want to split 'hello' into h e l l o in an array using only bash, I could do it in sed with sed 's/./& /g' but I want to know how to split a string into an array in Bash when I do not know what the delimiter would be, or the delimiter is any single character. I don’t think I can use ${i// /} without some creativity because the delimiter is an unknown, and I don’t think that expression accepts regex. I tried using BASH_REMATCH with [[ string =~ ([a-z].).* ]] but it doesn’t work as I expected. What is the proper way to use only bash to accomplish a string.split() type of behavior? The reason is that I am trying to write the rev utility in all bash: