Thanks for the tip! I'll try to figure out if something similar is happening on either of the machines I'm using. That's a bummer that an in-place update function would be allocating behind the scenes...
I'm guessing the data is copied to a temporary buffer. The target GL buffer can still be in flight for previous operations.
If I remember correctly, that safety can be disabled with the right incantation of flags on the buffer.