The problem is not len. The problem is that you are trying to take the address of the array, rather than the address of the first element of the array; the types simply don't match.
Instead:
unsigned char* buf = &tmp[0];
Also, the array name conveniently (FSVO "conveniently") decays to &tmp[0] anyway, so you could write simply:
unsigned char* buf = tmp;
In addition you are presently not using a constant value for the array's dimension — ensure that len is made const and initialised with a constant value. In C++11, this'd better be constexpr to really ensure that you're not accidentally attempting to use GCC VLAs.
tmpisunsigned char[3]. Nothing else. There is nounsigned char**here anywhere, and certainly nochar**.unsigned char*(pointer to anunsigned char) andunsigned char(*)[3](pointer to an array of threeunsigned chars), not betweenunsigned char*andunsigned char**. Note that I do ignore the VLA component and pretend that the array dimension is fixed at3, as it's supposed to be.