Can someone explain to me how s2 becomes "ice" at the end?

Question

#include <stdio.h>
#include<string.h>
int main() {
char s1[]="Short Message Service",*s2,*s3;
s2=strchr(s1,'M');
puts(s1);
puts(s2);
puts(s3);
s3=strrchr(s2,'S');
puts(s1);
puts(s2);
puts(s3);
strncpy(s1+1,s2,1);
puts(s1);
puts(s2);
puts(s3);
strcpy(s1+2,s3);
puts(s1);
puts(s2);
puts(s3);
return 0;
}

Answer 1

Short Message Service\0
SMort Message Service\0
SMService\0age Service\0

At the start, the pointer s2 points to the 7th character, M. When the last strcpy executes, it overwrites the 3rd character through the 10th with the word "Service" plus terminating null. At the 7th character, s2 now points to the 'i' in "ice\0".