Fbackward_prefix_chars: stay within buffer bounds