diff -r 07b815faa6ac -r f00d03835dd9 src/server/plugins/postgresql/webdav.c
--- a/src/server/plugins/postgresql/webdav.c	Tue Dec 30 21:44:49 2025 +0100
+++ b/src/server/plugins/postgresql/webdav.c	Tue Jan 13 18:09:20 2026 +0100
@@ -489,7 +489,7 @@
     // create sql query
     const char *query = NULL;
     CxBuffer sql;
-    if(cxBufferInit(&sql, NULL, 2048, a, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
+    if(cxBufferInit(&sql, a, NULL, 2048, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
         return 1;
     }
     
@@ -518,10 +518,10 @@
     int nparam = 2;
     if(!rq->allprop) {
         size_t bufsize = rq->propcount < 200 ? 8 + rq->propcount * 32 : 4096;
-        if(cxBufferInit(&xmlns_buf, NULL, bufsize, a, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
+        if(cxBufferInit(&xmlns_buf, a, NULL, bufsize, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
             return 1;
         }
-        if(cxBufferInit(&pname_buf, NULL, bufsize, a, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
+        if(cxBufferInit(&pname_buf, a, NULL, bufsize, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
             cxBufferDestroy(&sql);
             cxBufferDestroy(&xmlns_buf);
             return 1;
@@ -1110,7 +1110,7 @@
     if(!sql) {
         return NULL;
     }
-    if(cxBufferInit(sql, NULL, 1024, pool_allocator(pool), CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
+    if(cxBufferInit(sql, pool_allocator(pool), NULL, 1024, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
         pool_free(pool, sql);
         return NULL;
     }
@@ -1182,7 +1182,7 @@
     if(!sql) {
         return NULL;
     }
-    if(cxBufferInit(sql, NULL, 1024, pool_allocator(pool), CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
+    if(cxBufferInit(sql, pool_allocator(pool), NULL, 1024, CX_BUFFER_AUTO_EXTEND|CX_BUFFER_FREE_CONTENTS)) {
         pool_free(pool, sql);
         return NULL;
     }