speexpay: Directly attach payload to the output buffer instead of copying it