Fix oob read in RCons.flush()