tls_tstream: use a dynamic buffer for the push case