How about this:
vec3* client::pos()
{
return (vec3*)(state() + 0x1C);
}
This way, pos() should return a vec3 pointer pointing to the internally stored data. Callers of pos() can then directly modify that data (if that's really what you want).
Note that you're giving out pointers to internal memory, you have to somehow deal with memory lifetime issues (eg. what happens if state() points to different memory later while somebody still uses the return value of pos()?).