buffer: ensure realloc size includes current offset and length.