Similar to #778, htuch/envoy@1cce012 demonstrates another issue where prepended bytes get dropped (expect to see bbbbbeeee..., get eeee... instead.
There is a setup involving empty string add, reserve with empty commit, buffer fragment ownership transfer via evbuffer_add_reference with an empty buffer. Take any of these away and the correct behavior occurs.
This was discovered via our oss-fuzz buffer fuzzer (Envoy)