splice: fix racy pipe->buffers uses