diff --git a/crates/clawhdf5-format/src/gather.rs b/crates/clawhdf5-format/src/gather.rs
index 08480f1..5f73dbd 100644
--- a/crates/clawhdf5-format/src/gather.rs
+++ b/crates/clawhdf5-format/src/gather.rs
@@ -454,9 +454,9 @@ pub(crate) fn gather_storage<S: Storage + ?Sized>(
         if error.is_some() {
             return;
         }
-        // Checked by the first walk.
-        let mut at = first as usize * elem_size;
-        let mut len = n as usize * elem_size;
+        // Checked by the first walk (these cannot saturate or wrap).
+        let mut at = crate::addr::saturating_usize(first).wrapping_mul(elem_size);
+        let mut len = crate::addr::saturating_usize(n).wrapping_mul(elem_size);
         while len > 0 {
             while spans.get(span).is_some_and(|s| s.out_end <= out.len()) {
                 span += 1;
diff --git a/crates/clawhdf5-format/src/storage.rs b/crates/clawhdf5-format/src/storage.rs
index 482cfad..08720ab 100644
--- a/crates/clawhdf5-format/src/storage.rs
+++ b/crates/clawhdf5-format/src/storage.rs
@@ -477,7 +477,8 @@ impl<'a> ExtentBytes<'a> {
                 ));
             }
             for ((slot, bytes), r) in slots.into_iter().zip(got).zip(&ranges) {
-                out[slot] = Extent::Bytes(exact_len(bytes, (r.end - r.start) as usize)?);
+                let len = crate::addr::saturating_usize(r.end - r.start);
+                out[slot] = Extent::Bytes(exact_len(bytes, len)?);
             }
         }
         Ok(ExtentBytes::Fetched { base, extents: out })