This is a problem with the underlying SSL_read() XS function, which can't take an undefined read buffer without issuing a warning.

Setting my $buf = '' in your code fixes it for me.