buffer.h: remove protected