should we `assert(buflen <= kMaxLength)`, or will that be taken care of before reaching this point?