[int_19h]

For escapes you can mutate the raw buffer with data in place, since a single escape always expands to fewer characters than the escape itself.