pad: Add a guard against getrange functions not filling a caller-provided buffer

It's a programming error to not do so and would cause all kinds of
problems in the caller that assumed its own buffer to have been filled.