We were writing to the wrong buffer with a wrong offset :( Bug present since the original introduction of the code in 04b28be1.