Look at strcpy docs:
char *strcpy( char *restrict dest, const char *restrict src );
Copies the null-terminated byte string pointed to by src, including
  the null terminator, to the character array whose first element is
  pointed to by dest.  The behavior is undefined if the dest array is
  not large enough. [...] (important but not relevant to the question so
  omitted part)
So strcpy does take 2 pointers. That's fine. It's not a bug.
To find the bug pay attention to (and think about it, it's logical): dest array must be large enough. What does "large enough" mean here? Well since the functions copies the string from src, including null terminator to dest it means dest must be at least the length of the string in src + 1 for the null terminator. That means strlen(src) + 1.
sizeof(src) is the same as sizeof(int*) which is the size of a char pointer on the platform. The size of the pointer. Not what you want.
The next error is that the functions returns the address of an automatic storage object, aka the result array. This means that the array will cease to exist when the function exits and thus the function returns a pointer to an object that is no longer valid. A solution to this would be to use malloc to allocate the array. Another is to change the signature of xpx to something similar to strcpy where the destination array is supplied.
So summing them you need something along this:
char* result = malloc(strlen(src) + 1);
Another bug (yes, technically it's not a bug, but semantically it's a bug in my opinion) is that src should be of const char* type.
Another source of potential problems and bugs is if the input is not well-behaved, e.g. if src is not null-terminated, but it is debatable how much responsibility this function should carry regarding this.