ffi.slice: saner semantics of len/cap.