Thank you for the patch. A couple of comments:

- the whole slow path (which loops calling _bufferedreader_raw_read()) should be surrounded by calls to ENTER_BUFFERED() and LEAVE_BUFFERED()

- other things:

+    if (!PyArg_ParseTuple(args, "O:readinto", &buffer))
+        return NULL;
+
+    if (PyObject_GetBuffer(buffer, &buf, PyBUF_CONTIG) == -1)
+        return NULL;

You should use the "w*" typecode instead (see the readinto implementation in Modules/_io/fileio.c for an example).

+            if (n == -2) {
+                Py_INCREF(Py_None);
+                res = Py_None;
+            }

If `written` is > 0, this should return the number of bytes instead (mimicking _bufferedreader_read_generic). Adding a test for that would be nice too (in Lib/test/test_io.py).