[buffer] Fix write()