buf: destroy() sets len to zero and mem to NULL

Was causing bug where detaching a destroyed buffer returned pointer and
length of previously freed memory block.