Fix #933: Correct offset handling in ArrayBufferInputStream