OutBuffer::around pos accepted a position past the initialized length of a Vec<u8>. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position.

The flaw was corrected by zero-filling that gap.