Correct buffer end pointer in IO_wdefault_doallocate (BZ #26874)