Many callers of this API pass an initialized buffer to the
second param, and assume this method fills it. But there’s
a branch where the buffer is not filled, yet no return value
to know it wasn’t filled.  So as to not change this public
API’s behaviour, I just added an assert to tell the analyzer
that the error branch is “impossible”.

Change-Id: Ic77437170af76a2f964333a988cc6ba69eb78a46