diff --git a/include/grpc/slice.h b/include/grpc/slice.h
index ea66e09..8c32a30 100644
--- a/include/grpc/slice.h
+++ b/include/grpc/slice.h
@@ -102,9 +102,9 @@
 /* Create a slice pointing to constant memory */
 GPRAPI grpc_slice grpc_slice_from_static_buffer(const void *source, size_t len);
 
-/* Return a result slice derived from s, which shares a ref count with s, where
-   result.data==s.data+begin, and result.length==end-begin.
-   The ref count of s is increased by one.
+/* Return a result slice derived from s, which shares a ref count with \a s,
+   where result.data==s.data+begin, and result.length==end-begin. The ref count
+   of \a s is increased by one. Do not assign result back to \a s.
    Requires s initialized, begin <= end, begin <= s.length, and
    end <= source->length. */
 GPRAPI grpc_slice grpc_slice_sub(grpc_slice s, size_t begin, size_t end);
diff --git a/src/core/ext/filters/http/client/http_client_filter.c b/src/core/ext/filters/http/client/http_client_filter.c
index b896c7e..7bab7b1 100644
--- a/src/core/ext/filters/http/client/http_client_filter.c
+++ b/src/core/ext/filters/http/client/http_client_filter.c
@@ -313,7 +313,6 @@
         estimated_len += grpc_base64_estimate_encoded_size(
             op->payload->send_message.send_message->length, k_url_safe,
             k_multi_line);
-        estimated_len += 1; /* for the trailing 0 */
         grpc_slice path_with_query_slice = grpc_slice_malloc(estimated_len);
 
         /* memcopy individual pieces into this slice */
@@ -335,7 +334,7 @@
         char *t = (char *)GRPC_SLICE_START_PTR(path_with_query_slice);
         /* safe to use strlen since base64_encode will always add '\0' */
         path_with_query_slice =
-            grpc_slice_sub(path_with_query_slice, 0, strlen(t));
+            grpc_slice_sub_no_ref(path_with_query_slice, 0, strlen(t));
 
         /* substitute previous path with the new path+query */
         grpc_mdelem mdelem_path_and_query = grpc_mdelem_from_slices(
@@ -349,7 +348,6 @@
         calld->on_complete = op->on_complete;
         op->on_complete = &calld->hc_on_complete;
         op->send_message = false;
-        grpc_slice_unref_internal(exec_ctx, path_with_query_slice);
       } else {
         /* Not all data is available. Fall back to POST. */
         gpr_log(GPR_DEBUG,