Fix off-by-one in buffer length in int_to_env