Because sizeof('\0') is actually sizeof(int) not sizeof(char).

This is achieved by encoding the type of function used in the first two
bytes.

First byte:
b: buffered

Second byte:
f: formatted

With one big limitation: It can only be fuzzed with what has been
parsed by the library beforehand.