s4:tls_tstream: also use a dynamic buffer for the pull side