The actual guarantees we are making in op_read_native() are:
- if _pcm == NULL, then _buf_sz <= 0 (requirement on the caller),
- op_get_packet_duration() will succeed and return a positive value
   no larger than 120*48 (guaranteed by op_collect_audio_packets()
   filtering out any packets with invalid TOC sequences), and
- nchannels is a small number greater than 0 (guaranteed by the
   validation in opus_parse_head()).
However, trying to assert these things is not enough to convince
 clang to take the nsamples*nchannels>_buf_sz or
 duration*nchannels>_buf_sz branches when _pcm==NULL, so instead
 we have to be a bit more direct.