1. It should not be possible to shrink a static stuffer; doing so can leak memory.
2. It would be useful to add a flag tracking whether a stuffer has ever had a "raw" (direct pointer) access. If so, the stuffer should not be realloc()'d within its life-cycle; otherwise the pointers may become invalid.

Although s2n does not display these patterns, we should add systematic defenses against any future regressions.