When p = limit - 1 from above:

We check if *(limit - 2) != '\n', then we set *(limit - 1) = '\n' then add one to p leaving p == limit.

Below we have std::min(bufsize - 1, (int)(p - base)) => std::min(bufsize - 1, bufsize) == bufsize - 1 => base[bufsize-1] == limit - 1

Then we're effectively doing *(limit -1) = '\0' and eating the newline we just added? Is that all that can happen, or did I make a mistake?

Yes, but it's not a guarantee that p = limit - 1 so I don't see the problem here.

There are numerous other stupid stuff in the code, such as it allocate a buffer and free it at every loop iteration.