buf size off-by-one