I happened to notice this while looking at Bug #35767.

Consider this (rather contrived) C prototype:

    /**
     * get_text:
     * @lang: (out) (allow-none): the ISO language code for the text
     * @wordcount: (out) (allow-none): the word-count for the text
     * @error: (out) (allow-none): used to raise an exception
     * 
     * Returns: (transfer full): some text, or %NULL on errors
     */
    gchar *get_text (gchar **lang, guint *wordcount, GError **error);

Suppose we want to use it as an implementation of this D-Bus method:

    GetText () -> (s: lang, u: wordcount, s: text)

The @text argument would be the third <arg> element, and would have the ...GLib.ReturnVal="error" annotation.

However, invoke_object_method always serializes the ReturnVal first:

    /* First, append the return value, unless it's synthetic */

so it would actually return (s: text, s: lang, u: wordcount) whenever it was successful!

Since this has never worked properly, I'd be inclined to just "fix" this by making dbus-binding-tool forbid the use of ReturnVal unless it's on the first "out" <arg>. The only d-b-t reimplementations I'm aware of are in telepathy-glib, and they don't support ReturnVal anyway.