Well, that's not exactly true. mbstate_t is defined by the C standard, and indeed, it says pretty much nothing about its nature, except that it's not an array. But on any platform I worked with (including Windows) it's an integer.
ֹUnder Linux it is structure and AFAIK gcc uses iconv for conversion. So I'm not sure how safe is to write anything to it.
I think, it is perfectly fair to assume that it is at least a POD and sizeof(mbstate_t) >= 1, which makes it possible to store information about surrogate pairs in it.
The C++ standard does give some hints regarding how the conversion state shall be handled by the stream. In particular, it specifies that the state will be value-initialized at the beginning of the conversion, and it will call `shift` at the end of the conversion in order to finalize the converted character sequence and return the state to its initial value.
Not that it makes it easier to use mbstate_t with UCI under the hood, but it seems possible (theoretically, at least) to implement the complete UTF-16 <-> char conversion with it.
I was thinking about it but unfortunately standard does not specify how mbstate_t initialized. If I could assume that it is at leaset POD filled with zeros I could do something but I actually can't. At least I didn't find any reference for this.