buf: Add out-value 'len' for detach()

Pointee is set to length of the returned memory block. If no block is
attached to the buffer, it is set to zero.