Both of these methods call ftoa_left without calling reserve ahead of time:
basic_buffered_print::do_print(double)
basic_buffered_print::do_print(fixed&&)
If the value to convert or the precision is large then ftoa_left uses buffer_size to avoid issues. However, for other cases ftoa_left can write out of bounds
I am not certain how much space must be reserved. However, 2^53 is 16 digits. Maybe 1 + 16 + 1 + precision would be enough space to reserve (where the additional 1s are '-' and '.')