off-by-one in assert