In your example, whether His boss is analysed as a DP or as an NP with the noun boss as head, the possessive his does not c-command John (you are mistaken in this respect), which, as a consequence, is 'free' and satisfies Principle C of Binding Theory, as all r-expressions must. What Principle C says is only that r-expressions must not be c-commanded (and therefore automatically 'bound') by any co-referential expression, be it in the same 'binding domain' (the clause, in this case) or in a higher one, but that does not block co-reference between his and John: as his does not c-command John, it cannot bind it either (= make John obligatorily co-referential with it). Principle C allows his and John to not be co-referential; it by no means forces then to be non-coreferential, a very different claim. In consequence, in your example the possessive his may indeed refer to the same individual as the noun John does (= John, in that case), but it need not; it may also refer to any other male individual. The only r-expression that does c-command John in your example is His boss, but His boss cannot possibly be interpreted as referring to the same individual John does; if it could, the r-expression John would automatically be 'bound', in violation of Principle C of Binding Theory, and to save the sentence it would be necessary to replace it with the matching reflexive himself, according to Principle A.