It is very likely my lack of understanding of how RPC rather than a real problem, but looking at this I cannot figure out how two applications wanting to provide their own callback for onSsmlMarkReached can do so. Since it seems to be necessary to assign the callback to the global pointer, it appears that, to be on the safe side, application developer should assign the old value of onSsmlMarkReached to a temporary variable before passing any speech to NVDA, assign their own callback, speak whatever has to be spoken, and restore the old value afterwards. Would it be possible to pass pointer to onSsmlMarkReached as an additional parameter to nvdaController_speakSsml instead of using the single global callback?

it appears that, to be on the safe side, application developer should assign the old value of onSsmlMarkReached to a temporary variable before passing any speech to NVDA, assign their own callback, speak whatever has to be spoken, and restore the old value afterwards.

That's not necessary. The old value is nullptr anyway and the internal nvdaController_onSsmlMarkReached only calls the exported pointer when it is set correctly.

Would it be possible to pass pointer to onSsmlMarkReached as an additional parameter to nvdaController_speakSsml instead of using the single global callback?

That would be a lot nicer indeed, though I don't think we'd be able to pass the function pointer over RPC.

I'll have a look into this.

it appears that, to be on the safe side, application developer should assign the old value of onSsmlMarkReached to a temporary variable before passing any speech to NVDA, assign their own callback, speak whatever has to be spoken, and restore the old value afterwards.

That's not necessary. The old value is nullptr anyway and the internal nvdaController_onSsmlMarkReached only calls the exported pointer when it is set correctly.

Backing up and restoring the old function pointer seems to still be necessary, without doing so I see no way in which two applications can provide their own callback. Without backing up and restoring, the last assigned callback will always be used.

Every application can provide its own callback because the callback is stored in the user space of the client. The server, NVDA in this case, doesn't know anything about what the callback does. A callback is just RPC in the opposite direction.

Am I write in understanding that if the function is called with asynchronous as True, the mark callback will not be ever fired?

This is correct. As per the docs about callbacks:

The callback function ... lets the server query the client for information in the context of the original call. Callbacks are special cases of remote calls that execute as part of a single thread. A callback is issued in the context of a remote call. Any remote procedure defined as part of the same interface as the static callback function can call the callback function.

So in other words, a callback can only be called during a call. Calling the callback as part of an async call that was already completed wouldn't work.