Are you sure that sizeof(av) yields the correct length?
Other places in the code use (av.length() + 1) as the number of bytes to copy.
See ReadLinkCompletion().
Can you check?