Fixed incorrect variable in buffer_append_va (thanks, Max!).
This bug only affected the heap-allocation path, so buffer appends <= 256
bytes wouldn't trigger the bug, as we did them on the stack.
This bug only affected the heap-allocation path, so buffer appends <= 256
bytes wouldn't trigger the bug, as we did them on the stack.