diff --git a/src/ffi_avx512.rs b/src/ffi_avx512.rs
index 67947746..afa0221b 100644
--- a/src/ffi_avx512.rs
+++ b/src/ffi_avx512.rs
@@ -70,6 +70,7 @@ pub unsafe fn xof_many(
     flags: u8,
     out: &mut [u8],
 ) {
+    debug_assert_eq!(0, out.len() % BLOCK_LEN, "whole blocks only");
     ffi::blake3_xof_many_avx512(
         cv.as_ptr(),
         block.as_ptr(),
diff --git a/src/platform.rs b/src/platform.rs
index 3f47718e..590a77cc 100644
--- a/src/platform.rs
+++ b/src/platform.rs
@@ -286,6 +286,7 @@ impl Platform {
         flags: u8,
         out: &mut [u8],
     ) {
+        debug_assert_eq!(0, out.len() % BLOCK_LEN, "whole blocks only");
         if out.is_empty() {
             // The current assembly implementation always outputs at least 1 block.
             return;
diff --git a/src/portable.rs b/src/portable.rs
index 822cd0d4..4181f279 100644
--- a/src/portable.rs
+++ b/src/portable.rs
@@ -185,6 +185,7 @@ pub fn xof_many(
     flags: u8,
     out: &mut [u8],
 ) {
+    debug_assert_eq!(0, out.len() % BLOCK_LEN, "whole blocks only");
     for out_block in out.chunks_exact_mut(64) {
         out_block.copy_from_slice(&compress_xof(cv, block, block_len, counter, flags));
         counter += 1;