diff --git a/runtime/src/iree/hal/buffer_view.c b/runtime/src/iree/hal/buffer_view.c
index e0268fc..fa804fa 100644
--- a/runtime/src/iree/hal/buffer_view.c
+++ b/runtime/src/iree/hal/buffer_view.c
@@ -36,6 +36,23 @@
                             "no shape dimensions specified");
   }
 
+  iree_device_size_t byte_length = 0;
+  if (encoding_type == IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR) {
+    IREE_RETURN_IF_ERROR(iree_hal_buffer_compute_view_size(
+        shape_rank, shape, element_type, encoding_type, &byte_length));
+    if (IREE_UNLIKELY(byte_length > iree_hal_buffer_byte_length(buffer))) {
+      return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                              "buffer view byte length %" PRIdsz
+                              " exceeds backing buffer byte length %" PRIdsz,
+                              byte_length, iree_hal_buffer_byte_length(buffer));
+    }
+  } else {
+    iree_device_size_t element_count = 0;
+    IREE_RETURN_IF_ERROR(iree_hal_buffer_view_compute_element_count(
+        shape_rank, shape, &element_count));
+    IREE_RETURN_IF_ERROR(iree_hal_element_compute_packed_byte_count(
+        element_type, element_count, &byte_length));
+  }
   IREE_TRACE_ZONE_BEGIN(z0);
 
   // Allocate and initialize the iree_hal_buffer_view_t struct.
@@ -53,13 +70,10 @@
     buffer_view->element_type = element_type;
     buffer_view->encoding_type = encoding_type;
     buffer_view->shape_rank = shape_rank;
-    iree_device_size_t element_count = 1;
     for (iree_host_size_t i = 0; i < shape_rank; ++i) {
       buffer_view->shape[i] = shape[i];
-      element_count *= shape[i];
     }
-    buffer_view->byte_length = iree_hal_element_packed_byte_count(
-        buffer_view->element_type, element_count);
+    buffer_view->byte_length = byte_length;
     *out_buffer_view = buffer_view;
   }
 
@@ -129,10 +143,10 @@
   return buffer_view->shape[index];
 }
 
-IREE_API_EXPORT iree_host_size_t
+IREE_API_EXPORT iree_device_size_t
 iree_hal_buffer_view_element_count(const iree_hal_buffer_view_t* buffer_view) {
   IREE_ASSERT_ARGUMENT(buffer_view);
-  iree_host_size_t element_count = 1;
+  iree_device_size_t element_count = 1;
   for (iree_host_size_t i = 0; i < buffer_view->shape_rank; ++i) {
     element_count *= buffer_view->shape[i];
   }
@@ -177,10 +191,9 @@
                             shape_rank, buffer_view->shape_rank);
   }
 
-  iree_device_size_t new_element_count = 1;
-  for (iree_host_size_t i = 0; i < shape_rank; ++i) {
-    new_element_count *= shape[i];
-  }
+  iree_device_size_t new_element_count = 0;
+  IREE_RETURN_IF_ERROR(iree_hal_buffer_view_compute_element_count(
+      shape_rank, shape, &new_element_count));
   iree_device_size_t old_element_count =
       iree_hal_buffer_view_element_count(buffer_view);
   if (new_element_count != old_element_count) {
diff --git a/runtime/src/iree/hal/buffer_view.h b/runtime/src/iree/hal/buffer_view.h
index ea7b431..1765469 100644
--- a/runtime/src/iree/hal/buffer_view.h
+++ b/runtime/src/iree/hal/buffer_view.h
@@ -116,13 +116,6 @@
 #define iree_hal_element_dense_byte_count(element_type) \
   ((iree_hal_element_bit_count(element_type) + 8 - 1) / 8)
 
-// Returns the total byte count for |element_count| densely-packed elements of
-// |element_type|. For sub-byte types, multiple elements share a byte
-// (e.g. 8 i4 elements = 4 bytes). For byte-aligned types, this is equivalent
-// to element_count * iree_hal_element_dense_byte_count(element_type).
-#define iree_hal_element_packed_byte_count(element_type, element_count) \
-  (((element_count) * iree_hal_element_bit_count(element_type) + 7) / 8)
-
 // Returns true if the given |element_type| represents an integer of exactly
 // |bit_width|. This ignores the signedness of the integer type.
 #define iree_hal_element_type_is_integer(element_type, bit_width) \
@@ -273,7 +266,7 @@
     iree_host_size_t shape_rank);
 
 // Returns the total number of elements stored in the view.
-IREE_API_EXPORT iree_host_size_t
+IREE_API_EXPORT iree_device_size_t
 iree_hal_buffer_view_element_count(const iree_hal_buffer_view_t* buffer_view);
 
 // Returns the element type of the buffer.
diff --git a/runtime/src/iree/hal/buffer_view_util.c b/runtime/src/iree/hal/buffer_view_util.c
index 6ee8a07..3d10a60 100644
--- a/runtime/src/iree/hal/buffer_view_util.c
+++ b/runtime/src/iree/hal/buffer_view_util.c
@@ -18,6 +18,62 @@
 // Buffer view math
 //===----------------------------------------------------------------------===//
 
+IREE_API_EXPORT iree_status_t iree_hal_buffer_view_compute_element_count(
+    iree_host_size_t shape_rank, const iree_hal_dim_t* shape,
+    iree_device_size_t* out_element_count) {
+  IREE_ASSERT_ARGUMENT(!shape_rank || shape);
+  IREE_ASSERT_ARGUMENT(out_element_count);
+  *out_element_count = 0;
+
+  // A zero anywhere makes the product zero, even if earlier dimensions would
+  // overflow before reaching it.
+  for (iree_host_size_t i = 0; i < shape_rank; ++i) {
+    if (shape[i] == 0) return iree_ok_status();
+  }
+
+  iree_device_size_t element_count = 1;
+  for (iree_host_size_t i = 0; i < shape_rank; ++i) {
+    if (IREE_UNLIKELY(!iree_device_size_checked_mul(element_count, shape[i],
+                                                    &element_count))) {
+      return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                              "shape element count overflows device size at "
+                              "dimension %" PRIhsz,
+                              i);
+    }
+  }
+  *out_element_count = element_count;
+  return iree_ok_status();
+}
+
+IREE_API_EXPORT iree_status_t iree_hal_element_compute_packed_byte_count(
+    iree_hal_element_type_t element_type, iree_device_size_t element_count,
+    iree_device_size_t* out_byte_count) {
+  IREE_ASSERT_ARGUMENT(out_byte_count);
+  *out_byte_count = 0;
+
+  const iree_host_size_t element_bit_count =
+      iree_hal_element_bit_count(element_type);
+  // Compute ceil(element_count * element_bit_count / 8) without allowing
+  // the intermediate bit count to overflow.
+  iree_device_size_t whole_byte_length = 0;
+  if (IREE_UNLIKELY(!iree_device_size_checked_mul(
+          element_count / 8, element_bit_count, &whole_byte_length))) {
+    return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                            "packed byte count overflows device size");
+  }
+  const iree_device_size_t trailing_bit_count =
+      (element_count % 8) * element_bit_count;
+  const iree_device_size_t trailing_byte_length = (trailing_bit_count + 7) / 8;
+  iree_device_size_t byte_count = 0;
+  if (IREE_UNLIKELY(!iree_device_size_checked_add(
+          whole_byte_length, trailing_byte_length, &byte_count))) {
+    return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                            "packed byte count overflows device size");
+  }
+  *out_byte_count = byte_count;
+  return iree_ok_status();
+}
+
 IREE_API_EXPORT iree_status_t iree_hal_buffer_compute_view_size(
     iree_host_size_t shape_rank, const iree_hal_dim_t* shape,
     iree_hal_element_type_t element_type,
@@ -31,16 +87,17 @@
 
   switch (encoding_type) {
     case IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR: {
-      if (IREE_UNLIKELY(iree_hal_element_bit_count(element_type) == 0)) {
+      const iree_host_size_t element_bit_count =
+          iree_hal_element_bit_count(element_type);
+      if (IREE_UNLIKELY(element_bit_count == 0)) {
         return iree_make_status(IREE_STATUS_INVALID_ARGUMENT,
                                 "opaque element types cannot be indexed");
       }
-      iree_device_size_t element_count = 1;
-      for (iree_host_size_t i = 0; i < shape_rank; ++i) {
-        element_count *= shape[i];
-      }
-      byte_length =
-          iree_hal_element_packed_byte_count(element_type, element_count);
+      iree_device_size_t element_count = 0;
+      IREE_RETURN_IF_ERROR(iree_hal_buffer_view_compute_element_count(
+          shape_rank, shape, &element_count));
+      IREE_RETURN_IF_ERROR(iree_hal_element_compute_packed_byte_count(
+          element_type, element_count, &byte_length));
       break;
     }
     default:
diff --git a/runtime/src/iree/hal/buffer_view_util.h b/runtime/src/iree/hal/buffer_view_util.h
index 529e08a..f32803c 100644
--- a/runtime/src/iree/hal/buffer_view_util.h
+++ b/runtime/src/iree/hal/buffer_view_util.h
@@ -24,6 +24,18 @@
 // Buffer view math
 //===----------------------------------------------------------------------===//
 
+// Calculates the number of elements in |shape| without wrapping on overflow.
+// Any zero dimension produces an element count of zero.
+IREE_API_EXPORT iree_status_t iree_hal_buffer_view_compute_element_count(
+    iree_host_size_t shape_rank, const iree_hal_dim_t* shape,
+    iree_device_size_t* out_element_count);
+
+// Calculates the number of bytes for densely packed elements without wrapping
+// on overflow. A zero-bit element type produces zero bytes.
+IREE_API_EXPORT iree_status_t iree_hal_element_compute_packed_byte_count(
+    iree_hal_element_type_t element_type, iree_device_size_t element_count,
+    iree_device_size_t* out_byte_count);
+
 // Calculates the allocation size of a buffer view.
 IREE_API_EXPORT iree_status_t iree_hal_buffer_compute_view_size(
     iree_host_size_t shape_rank, const iree_hal_dim_t* shape,
diff --git a/runtime/src/iree/hal/buffer_view_util_test.cc b/runtime/src/iree/hal/buffer_view_util_test.cc
index b62a3ba..25e6f24 100644
--- a/runtime/src/iree/hal/buffer_view_util_test.cc
+++ b/runtime/src/iree/hal/buffer_view_util_test.cc
@@ -87,6 +87,233 @@
   return iree_make_status(IREE_STATUS_CANCELLED, "contract check complete");
 }
 
+TEST(BufferViewUtilTest, ComputeElementCount) {
+  iree_device_size_t element_count = 0;
+  IREE_ASSERT_OK(iree_hal_buffer_view_compute_element_count(
+      /*shape_rank=*/0, /*shape=*/NULL, &element_count));
+  EXPECT_EQ(1u, element_count);
+
+  const iree_hal_dim_t shape[] = {2, 3};
+  IREE_ASSERT_OK(iree_hal_buffer_view_compute_element_count(
+      IREE_ARRAYSIZE(shape), shape, &element_count));
+  EXPECT_EQ(6u, element_count);
+
+  const iree_hal_dim_t max_shape[] = {IREE_DEVICE_SIZE_MAX};
+  IREE_ASSERT_OK(iree_hal_buffer_view_compute_element_count(
+      IREE_ARRAYSIZE(max_shape), max_shape, &element_count));
+  EXPECT_EQ(IREE_DEVICE_SIZE_MAX, element_count);
+
+  const iree_hal_dim_t zero_first_shape[] = {0, IREE_DEVICE_SIZE_MAX, 2};
+  IREE_ASSERT_OK(iree_hal_buffer_view_compute_element_count(
+      IREE_ARRAYSIZE(zero_first_shape), zero_first_shape, &element_count));
+  EXPECT_EQ(0u, element_count);
+
+  const iree_hal_dim_t zero_last_shape[] = {IREE_DEVICE_SIZE_MAX, 2, 0};
+  IREE_ASSERT_OK(iree_hal_buffer_view_compute_element_count(
+      IREE_ARRAYSIZE(zero_last_shape), zero_last_shape, &element_count));
+  EXPECT_EQ(0u, element_count);
+
+  const iree_hal_dim_t overflow_shape[] = {IREE_DEVICE_SIZE_MAX, 2};
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_compute_element_count(
+          IREE_ARRAYSIZE(overflow_shape), overflow_shape, &element_count));
+  EXPECT_EQ(0u, element_count);
+}
+
+TEST(BufferViewUtilTest, ComputePackedByteCount) {
+  iree_device_size_t byte_count = 0;
+  IREE_ASSERT_OK(iree_hal_element_compute_packed_byte_count(
+      IREE_HAL_ELEMENT_TYPE_INT_8, IREE_DEVICE_SIZE_MAX, &byte_count));
+  EXPECT_EQ(IREE_DEVICE_SIZE_MAX, byte_count);
+
+  IREE_ASSERT_OK(iree_hal_element_compute_packed_byte_count(
+      IREE_HAL_ELEMENT_TYPE_INT_4, IREE_DEVICE_SIZE_MAX, &byte_count));
+  EXPECT_EQ(IREE_DEVICE_SIZE_MAX / 2 + 1, byte_count);
+
+  IREE_ASSERT_OK(iree_hal_element_compute_packed_byte_count(
+      IREE_HAL_ELEMENT_TYPE_INT_4, 3, &byte_count));
+  EXPECT_EQ(2u, byte_count);
+
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_element_compute_packed_byte_count(
+          IREE_HAL_ELEMENT_TYPE_INT_16, IREE_DEVICE_SIZE_MAX, &byte_count));
+  EXPECT_EQ(0u, byte_count);
+
+  const iree_hal_element_type_t int_24_type =
+      iree_hal_make_element_type(IREE_HAL_NUMERICAL_TYPE_INTEGER, 24);
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_element_compute_packed_byte_count(
+          int_24_type, 8 * (IREE_DEVICE_SIZE_MAX / 24) + 7, &byte_count));
+  EXPECT_EQ(0u, byte_count);
+}
+
+TEST(BufferViewUtilTest, ComputeViewSizeRejectsElementCountOverflow) {
+  const iree_hal_dim_t zero_byte_shape[] = {IREE_DEVICE_SIZE_MAX / 2 + 1, 2};
+  iree_device_size_t allocation_size = 0;
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_compute_view_size(
+          IREE_ARRAYSIZE(zero_byte_shape), zero_byte_shape,
+          IREE_HAL_ELEMENT_TYPE_INT_8, IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+          &allocation_size));
+
+  if (sizeof(iree_device_size_t) == sizeof(uint64_t)) {
+    const iree_hal_dim_t one_byte_shape[] = {
+        static_cast<iree_hal_dim_t>(UINT64_C(274177)),
+        static_cast<iree_hal_dim_t>(UINT64_C(67280421310721))};
+    IREE_EXPECT_STATUS_IS(
+        IREE_STATUS_OUT_OF_RANGE,
+        iree_hal_buffer_compute_view_size(
+            IREE_ARRAYSIZE(one_byte_shape), one_byte_shape,
+            IREE_HAL_ELEMENT_TYPE_INT_8, IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+            &allocation_size));
+  }
+}
+
+TEST(BufferViewUtilTest, ComputeViewSizeChecksPackedByteCount) {
+  const iree_hal_dim_t max_shape[] = {IREE_DEVICE_SIZE_MAX};
+  iree_device_size_t allocation_size = 0;
+  IREE_ASSERT_OK(iree_hal_buffer_compute_view_size(
+      IREE_ARRAYSIZE(max_shape), max_shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, &allocation_size));
+  EXPECT_EQ(IREE_DEVICE_SIZE_MAX, allocation_size);
+
+  IREE_ASSERT_OK(iree_hal_buffer_compute_view_size(
+      IREE_ARRAYSIZE(max_shape), max_shape, IREE_HAL_ELEMENT_TYPE_INT_4,
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, &allocation_size));
+  EXPECT_EQ(IREE_DEVICE_SIZE_MAX / 2 + 1, allocation_size);
+
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_compute_view_size(
+          IREE_ARRAYSIZE(max_shape), max_shape, IREE_HAL_ELEMENT_TYPE_INT_16,
+          IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, &allocation_size));
+
+  const iree_hal_dim_t addition_overflow_shape[] = {
+      8 * (IREE_DEVICE_SIZE_MAX / 24) + 7};
+  const iree_hal_element_type_t int_24_type =
+      iree_hal_make_element_type(IREE_HAL_NUMERICAL_TYPE_INTEGER, 24);
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_compute_view_size(IREE_ARRAYSIZE(addition_overflow_shape),
+                                        addition_overflow_shape, int_24_type,
+                                        IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+                                        &allocation_size));
+}
+
+TEST(BufferViewUtilTest, ComputeViewSizeAllowsZeroDimensions) {
+  const iree_hal_dim_t shape[] = {IREE_DEVICE_SIZE_MAX, 2, 0};
+  iree_device_size_t allocation_size = IREE_DEVICE_SIZE_MAX;
+  IREE_ASSERT_OK(iree_hal_buffer_compute_view_size(
+      IREE_ARRAYSIZE(shape), shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, &allocation_size));
+  EXPECT_EQ(0u, allocation_size);
+}
+
+TEST(BufferViewUtilTest, CreateAndReshapeValidateShapes) {
+  iree_hal_allocator_t* allocator = NULL;
+  IREE_ASSERT_OK(iree_hal_allocator_create_heap(
+      iree_make_cstring_view("host_local"), iree_allocator_system(),
+      iree_allocator_system(), &allocator));
+
+  iree_hal_buffer_params_t buffer_params = {
+      /*.usage=*/IREE_HAL_BUFFER_USAGE_DEFAULT,
+      /*.access=*/IREE_HAL_MEMORY_ACCESS_ALL,
+      /*.type=*/IREE_HAL_MEMORY_TYPE_HOST_LOCAL,
+      /*.queue_affinity=*/0,
+  };
+  iree_hal_buffer_t* buffer = NULL;
+  IREE_ASSERT_OK(iree_hal_allocator_allocate_buffer(
+      allocator, buffer_params, /*allocation_size=*/1, &buffer));
+
+  const iree_hal_dim_t shape[] = {IREE_DEVICE_SIZE_MAX / 2 + 1, 2};
+  iree_hal_buffer_view_t* buffer_view = NULL;
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_create(buffer, IREE_ARRAYSIZE(shape), shape,
+                                  IREE_HAL_ELEMENT_TYPE_INT_8,
+                                  IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+                                  iree_allocator_system(), &buffer_view));
+  EXPECT_EQ(NULL, buffer_view);
+
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_create(buffer, IREE_ARRAYSIZE(shape), shape,
+                                  IREE_HAL_ELEMENT_TYPE_INT_8,
+                                  IREE_HAL_ENCODING_TYPE_OPAQUE,
+                                  iree_allocator_system(), &buffer_view));
+  EXPECT_EQ(NULL, buffer_view);
+
+  const iree_hal_dim_t max_shape[] = {IREE_DEVICE_SIZE_MAX};
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_create(buffer, IREE_ARRAYSIZE(max_shape), max_shape,
+                                  IREE_HAL_ELEMENT_TYPE_INT_16,
+                                  IREE_HAL_ENCODING_TYPE_OPAQUE,
+                                  iree_allocator_system(), &buffer_view));
+  EXPECT_EQ(NULL, buffer_view);
+
+  const iree_hal_dim_t oversized_shape[] = {2};
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_create(buffer, IREE_ARRAYSIZE(oversized_shape),
+                                  oversized_shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+                                  IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+                                  iree_allocator_system(), &buffer_view));
+  if (buffer_view) {
+    iree_hal_buffer_view_release(buffer_view);
+    buffer_view = NULL;
+  }
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(oversized_shape), oversized_shape,
+      IREE_HAL_ELEMENT_TYPE_INT_8, IREE_HAL_ENCODING_TYPE_OPAQUE,
+      iree_allocator_system(), &buffer_view));
+  EXPECT_EQ(2u, iree_hal_buffer_view_byte_length(buffer_view));
+  iree_hal_buffer_view_release(buffer_view);
+  buffer_view = NULL;
+
+  const iree_hal_dim_t valid_shape[] = {1, 1};
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(valid_shape), valid_shape,
+      IREE_HAL_ELEMENT_TYPE_INT_8, IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR,
+      iree_allocator_system(), &buffer_view));
+  iree_hal_dim_t reshape_shape[2];
+  if (sizeof(iree_device_size_t) == sizeof(uint64_t)) {
+    reshape_shape[0] = static_cast<iree_hal_dim_t>(UINT64_C(274177));
+    reshape_shape[1] = static_cast<iree_hal_dim_t>(UINT64_C(67280421310721));
+  } else {
+    reshape_shape[0] = 641;
+    reshape_shape[1] = 6700417;
+  }
+  IREE_EXPECT_STATUS_IS(
+      IREE_STATUS_OUT_OF_RANGE,
+      iree_hal_buffer_view_reshape(buffer_view, reshape_shape,
+                                   IREE_ARRAYSIZE(reshape_shape)));
+  EXPECT_EQ(1u, iree_hal_buffer_view_shape_dim(buffer_view, 0));
+  EXPECT_EQ(1u, iree_hal_buffer_view_shape_dim(buffer_view, 1));
+
+  iree_hal_buffer_view_release(buffer_view);
+
+  const iree_hal_dim_t zero_shape[] = {IREE_DEVICE_SIZE_MAX, 2, 0};
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(zero_shape), zero_shape,
+      IREE_HAL_ELEMENT_TYPE_INT_8, IREE_HAL_ENCODING_TYPE_OPAQUE,
+      iree_allocator_system(), &buffer_view));
+  EXPECT_EQ(0u, iree_hal_buffer_view_element_count(buffer_view));
+  const iree_hal_dim_t reshaped_zero_shape[] = {0, IREE_DEVICE_SIZE_MAX, 2};
+  IREE_ASSERT_OK(iree_hal_buffer_view_reshape(
+      buffer_view, reshaped_zero_shape, IREE_ARRAYSIZE(reshaped_zero_shape)));
+  EXPECT_EQ(0u, iree_hal_buffer_view_element_count(buffer_view));
+  EXPECT_EQ(0u, iree_hal_buffer_view_shape_dim(buffer_view, 0));
+  iree_hal_buffer_view_release(buffer_view);
+
+  iree_hal_buffer_release(buffer);
+  iree_hal_allocator_release(allocator);
+}
+
 TEST(BufferViewUtilTest, GenerateBufferUsesLogicalViewSizeForGenerator) {
   iree_allocator_t host_allocator = iree_allocator_system();
 
diff --git a/runtime/src/iree/hal/string_util_test.cc b/runtime/src/iree/hal/string_util_test.cc
index a9162d7..352ad76 100644
--- a/runtime/src/iree/hal/string_util_test.cc
+++ b/runtime/src/iree/hal/string_util_test.cc
@@ -506,7 +506,7 @@
   }
 
   // Returns the total number of elements stored in the view.
-  inline iree_host_size_t element_count() const noexcept {
+  inline iree_device_size_t element_count() const noexcept {
     return iree_hal_buffer_view_element_count(get());
   }
 
diff --git a/runtime/src/iree/modules/hal/inline/module.c b/runtime/src/iree/modules/hal/inline/module.c
index eb3aaf0..cba1db7 100644
--- a/runtime/src/iree/modules/hal/inline/module.c
+++ b/runtime/src/iree/modules/hal/inline/module.c
@@ -443,11 +443,11 @@
   }
 
   iree_hal_buffer_view_t* buffer_view = NULL;
-  IREE_RETURN_IF_ERROR(iree_hal_buffer_view_create(
+  iree_status_t status = iree_hal_buffer_view_create(
       subspan_buffer ? subspan_buffer : source_buffer, shape_rank, shape_dims,
-      element_type, encoding_type, state->host_allocator, &buffer_view));
-
+      element_type, encoding_type, state->host_allocator, &buffer_view);
   iree_hal_buffer_release(subspan_buffer);
+  IREE_RETURN_IF_ERROR(status);
 
   rets->r0 = iree_hal_buffer_view_move_ref(buffer_view);
   return iree_ok_status();
diff --git a/runtime/src/iree/modules/hal/module.c b/runtime/src/iree/modules/hal/module.c
index 6c51b13..f7cf848 100644
--- a/runtime/src/iree/modules/hal/module.c
+++ b/runtime/src/iree/modules/hal/module.c
@@ -656,11 +656,11 @@
   }
 
   iree_hal_buffer_view_t* buffer_view = NULL;
-  IREE_RETURN_IF_ERROR(iree_hal_buffer_view_create(
+  iree_status_t status = iree_hal_buffer_view_create(
       subspan_buffer ? subspan_buffer : source_buffer, shape_rank, shape_dims,
-      element_type, encoding_type, state->host_allocator, &buffer_view));
-
+      element_type, encoding_type, state->host_allocator, &buffer_view);
   iree_hal_buffer_release(subspan_buffer);
+  IREE_RETURN_IF_ERROR(status);
 
   rets->r0 = iree_hal_buffer_view_move_ref(buffer_view);
   return iree_ok_status();
diff --git a/runtime/src/iree/tooling/BUILD.bazel b/runtime/src/iree/tooling/BUILD.bazel
index 578f46f..c28fd98 100644
--- a/runtime/src/iree/tooling/BUILD.bazel
+++ b/runtime/src/iree/tooling/BUILD.bazel
@@ -154,6 +154,7 @@
         "//runtime/src/iree/modules/hal",
         "//runtime/src/iree/testing:gtest",
         "//runtime/src/iree/testing:gtest_main",
+        "//runtime/src/iree/testing:temp_file",
         "//runtime/src/iree/vm",
     ],
 )
diff --git a/runtime/src/iree/tooling/CMakeLists.txt b/runtime/src/iree/tooling/CMakeLists.txt
index 3275a2e..bbd9366 100644
--- a/runtime/src/iree/tooling/CMakeLists.txt
+++ b/runtime/src/iree/tooling/CMakeLists.txt
@@ -172,6 +172,7 @@
     iree::modules::hal
     iree::testing::gtest
     iree::testing::gtest_main
+    iree::testing::temp_file
     iree::vm
 )
 
diff --git a/runtime/src/iree/tooling/buffer_view_matchers.c b/runtime/src/iree/tooling/buffer_view_matchers.c
index 822ab9e..d61e096 100644
--- a/runtime/src/iree/tooling/buffer_view_matchers.c
+++ b/runtime/src/iree/tooling/buffer_view_matchers.c
@@ -8,6 +8,20 @@
 
 #include "iree/base/internal/math.h"
 
+static iree_status_t iree_hal_buffer_view_host_element_count(
+    const iree_hal_buffer_view_t* buffer_view,
+    iree_host_size_t* out_element_count) {
+  iree_device_size_t element_count =
+      iree_hal_buffer_view_element_count(buffer_view);
+  iree_host_size_t host_element_count = (iree_host_size_t)element_count;
+  if (IREE_UNLIKELY((iree_device_size_t)host_element_count != element_count)) {
+    return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                            "buffer view element count exceeds host size");
+  }
+  *out_element_count = host_element_count;
+  return iree_ok_status();
+}
+
 //===----------------------------------------------------------------------===//
 // iree_hal_buffer_equality_t
 //===----------------------------------------------------------------------===//
@@ -401,6 +415,10 @@
     return iree_ok_status();
   }
 
+  iree_host_size_t element_count = 0;
+  IREE_RETURN_IF_ERROR(
+      iree_hal_buffer_view_host_element_count(matchee, &element_count));
+
   iree_hal_buffer_mapping_t actual_mapping;
   IREE_RETURN_IF_ERROR(iree_hal_buffer_map_range(
       iree_hal_buffer_view_buffer(matchee), IREE_HAL_MAPPING_MODE_SCOPED,
@@ -410,8 +428,7 @@
 
   iree_host_size_t i = 0;
   const bool all_match = iree_hal_compare_buffer_elements_broadcast(
-      matcher->equality, matcher->value,
-      iree_hal_buffer_view_element_count(matchee), actual_contents, &i);
+      matcher->equality, matcher->value, element_count, actual_contents, &i);
   iree_hal_buffer_element_t actual_element = iree_hal_buffer_element_at(
       iree_hal_buffer_view_element_type(matchee), actual_contents, i);
 
@@ -512,13 +529,15 @@
         iree_string_builder_append_string(builder, IREE_SV(")")));
     *out_matched = false;
     return iree_ok_status();
-  } else if (iree_hal_buffer_view_element_count(matchee) !=
-             matcher->element_count) {
+  }
+  iree_device_size_t element_count =
+      iree_hal_buffer_view_element_count(matchee);
+  if (element_count != matcher->element_count) {
     IREE_RETURN_IF_ERROR(iree_string_builder_append_format(
         builder,
-        "whose element count (%" PRIhsz ") does not match expected (%" PRIhsz
+        "whose element count (%" PRIdsz ") does not match expected (%" PRIhsz
         ")",
-        iree_hal_buffer_view_element_count(matchee), matcher->element_count));
+        element_count, matcher->element_count));
     *out_matched = false;
     return iree_ok_status();
   }
@@ -533,8 +552,7 @@
   iree_host_size_t i = 0;
   const bool all_match = iree_hal_compare_buffer_elements_elementwise(
       matcher->equality, iree_hal_buffer_view_element_type(matchee),
-      iree_hal_buffer_view_element_count(matchee), matcher->elements,
-      actual_contents, &i);
+      matcher->element_count, matcher->elements, actual_contents, &i);
   iree_hal_buffer_element_t actual_element = iree_hal_buffer_element_at(
       iree_hal_buffer_view_element_type(matchee), actual_contents, i);
   iree_hal_buffer_element_t expected_element = iree_hal_buffer_element_at(
@@ -627,6 +645,10 @@
       matcher->expected, matchee, builder, out_matched));
   if (!*out_matched) return iree_ok_status();
 
+  iree_host_size_t element_count = 0;
+  IREE_RETURN_IF_ERROR(
+      iree_hal_buffer_view_host_element_count(matchee, &element_count));
+
   iree_hal_buffer_mapping_t actual_mapping;
   IREE_RETURN_IF_ERROR(iree_hal_buffer_map_range(
       iree_hal_buffer_view_buffer(matchee), IREE_HAL_MAPPING_MODE_SCOPED,
@@ -648,8 +670,7 @@
   iree_host_size_t i = 0;
   const bool all_match = iree_hal_compare_buffer_elements_elementwise(
       matcher->equality, iree_hal_buffer_view_element_type(matchee),
-      iree_hal_buffer_view_element_count(matchee), expected_contents,
-      actual_contents, &i);
+      element_count, expected_contents, actual_contents, &i);
   iree_hal_buffer_element_t actual_element = iree_hal_buffer_element_at(
       iree_hal_buffer_view_element_type(matchee), actual_contents, i);
   iree_hal_buffer_element_t expected_element = iree_hal_buffer_element_at(
diff --git a/runtime/src/iree/tooling/function_io.c b/runtime/src/iree/tooling/function_io.c
index 7351286..479f379 100644
--- a/runtime/src/iree/tooling/function_io.c
+++ b/runtime/src/iree/tooling/function_io.c
@@ -1074,18 +1074,50 @@
   iree_hal_buffer_view_t* buffer_view = NULL;
   IREE_RETURN_IF_ERROR(iree_tooling_create_buffer_view_from_variant(
       variant, device_allocator, host_allocator, &buffer_view));
+  iree_hal_buffer_t* buffer = iree_hal_buffer_view_buffer(buffer_view);
   iree_device_size_t byte_length =
       iree_hal_buffer_view_byte_length(buffer_view);
+  iree_device_size_t map_byte_length = byte_length;
+  if (iree_hal_buffer_view_encoding_type(buffer_view) ==
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR) {
+    // WebGPU requires four-byte-aligned mapping lengths; do not write padding.
+    iree_device_size_t padding = (4 - byte_length % 4) % 4;
+    iree_device_size_t backing_length = iree_hal_buffer_byte_length(buffer);
+    if (byte_length <= backing_length &&
+        padding <= backing_length - byte_length &&
+        (iree_device_size_t)(iree_host_size_t)(byte_length + padding) ==
+            byte_length + padding) {
+      map_byte_length += padding;
+    }
+  } else {
+    byte_length = iree_hal_buffer_byte_length(buffer);
+    map_byte_length = byte_length;
+  }
+  iree_host_size_t host_byte_length = (iree_host_size_t)byte_length;
+  if (IREE_UNLIKELY((iree_device_size_t)host_byte_length != byte_length)) {
+    iree_hal_buffer_view_release(buffer_view);
+    return iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                            "binary output byte length exceeds host size");
+  }
 
   // Map the buffer memory into a host pointer so we can access it.
   iree_hal_buffer_mapping_t mapping;
   iree_status_t status = iree_hal_buffer_map_range(
-      iree_hal_buffer_view_buffer(buffer_view), IREE_HAL_MAPPING_MODE_SCOPED,
-      IREE_HAL_MEMORY_ACCESS_READ, 0, IREE_HAL_WHOLE_BUFFER, &mapping);
+      buffer, IREE_HAL_MAPPING_MODE_SCOPED, IREE_HAL_MEMORY_ACCESS_READ, 0,
+      map_byte_length, &mapping);
 
   // Write to the file from the mapped memory.
   if (iree_status_is_ok(status)) {
-    status = iree_io_stream_write(stream, byte_length, mapping.contents.data);
+    if (IREE_UNLIKELY(host_byte_length > mapping.contents.data_length)) {
+      status = iree_make_status(IREE_STATUS_OUT_OF_RANGE,
+                                "binary output byte length %" PRIdsz
+                                " exceeds mapped buffer byte length %" PRIhsz,
+                                byte_length, mapping.contents.data_length);
+    }
+    if (iree_status_is_ok(status)) {
+      status =
+          iree_io_stream_write(stream, host_byte_length, mapping.contents.data);
+    }
   }
 
   iree_status_ignore(iree_hal_buffer_unmap_range(&mapping));
diff --git a/runtime/src/iree/tooling/function_io_test.cc b/runtime/src/iree/tooling/function_io_test.cc
index db2a1b0..7c7b561 100644
--- a/runtime/src/iree/tooling/function_io_test.cc
+++ b/runtime/src/iree/tooling/function_io_test.cc
@@ -6,12 +6,15 @@
 
 #include "iree/tooling/function_io.h"
 
+#include <fstream>
+
 #include "iree/base/api.h"
 #include "iree/hal/api.h"
 #include "iree/io/vec_stream.h"
 #include "iree/modules/hal/module.h"
 #include "iree/testing/gtest.h"
 #include "iree/testing/status_matchers.h"
+#include "iree/testing/temp_file.h"
 #include "iree/vm/api.h"
 
 namespace iree {
@@ -130,5 +133,128 @@
                         "\nresult[1]: hal.buffer_view\n" + buf_string2 + "\n");
 }
 
+TEST_F(FunctionIOTest, WriteOpaqueBufferViewUsesBackingBufferLength) {
+  iree_hal_buffer_params_t buffer_params = {
+      /*.usage=*/IREE_HAL_BUFFER_USAGE_DEFAULT,
+      /*.access=*/IREE_HAL_MEMORY_ACCESS_ALL,
+      /*.type=*/IREE_HAL_MEMORY_TYPE_HOST_LOCAL,
+      /*.queue_affinity=*/0,
+  };
+  iree_hal_buffer_t* buffer = NULL;
+  IREE_ASSERT_OK(iree_hal_allocator_allocate_buffer(
+      device_allocator, buffer_params, /*allocation_size=*/1, &buffer));
+  const uint8_t contents = 0x5A;
+  IREE_ASSERT_OK(iree_hal_buffer_map_write(buffer, 0, &contents, 1));
+
+  const iree_hal_dim_t shape[] = {2};
+  iree_hal_buffer_view_t* buffer_view = NULL;
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(shape), shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+      IREE_HAL_ENCODING_TYPE_OPAQUE, host_allocator, &buffer_view));
+  iree_hal_buffer_release(buffer);
+
+  vm::ref<iree_vm_list_t> outputs;
+  IREE_ASSERT_OK(iree_vm_list_create(iree_vm_make_undefined_type_def(), 1,
+                                     host_allocator, &outputs));
+  iree_vm_ref_t buffer_view_ref = iree_hal_buffer_view_move_ref(buffer_view);
+  IREE_ASSERT_OK(iree_vm_list_push_ref_move(outputs.get(), &buffer_view_ref));
+
+  testing::TempFilePath path("function_io_short_opaque_buffer", ".bin");
+  ASSERT_TRUE(path);
+  std::string output_spec = "@" + path.path();
+  iree_string_view_t spec =
+      iree_make_string_view(output_spec.data(), output_spec.size());
+  iree_string_view_list_t specs = {1, &spec};
+  IREE_ASSERT_OK(iree_tooling_write_variants(
+      outputs.get(), specs, /*max_element_count=*/1024,
+      /*default_stream=*/NULL, host_allocator));
+  std::ifstream output(path.path(), std::ios::binary);
+  ASSERT_TRUE(output);
+  EXPECT_EQ(contents, output.get());
+  EXPECT_EQ(std::char_traits<char>::eof(), output.get());
+}
+
+TEST_F(FunctionIOTest, WriteDenseBufferViewUsesLogicalByteLength) {
+  iree_hal_buffer_params_t buffer_params = {
+      /*.usage=*/IREE_HAL_BUFFER_USAGE_DEFAULT,
+      /*.access=*/IREE_HAL_MEMORY_ACCESS_ALL,
+      /*.type=*/IREE_HAL_MEMORY_TYPE_HOST_LOCAL,
+      /*.queue_affinity=*/0,
+  };
+  iree_hal_buffer_t* buffer = NULL;
+  IREE_ASSERT_OK(iree_hal_allocator_allocate_buffer(
+      device_allocator, buffer_params, /*allocation_size=*/8, &buffer));
+  const uint8_t contents[] = {1, 2, 3, 4, 5, 6, 7, 8};
+  IREE_ASSERT_OK(
+      iree_hal_buffer_map_write(buffer, 0, contents, IREE_ARRAYSIZE(contents)));
+
+  const iree_hal_dim_t shape[] = {3};
+  iree_hal_buffer_view_t* buffer_view = NULL;
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(shape), shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, host_allocator, &buffer_view));
+  iree_hal_buffer_release(buffer);
+
+  vm::ref<iree_vm_list_t> outputs;
+  IREE_ASSERT_OK(iree_vm_list_create(iree_vm_make_undefined_type_def(), 1,
+                                     host_allocator, &outputs));
+  iree_vm_ref_t buffer_view_ref = iree_hal_buffer_view_move_ref(buffer_view);
+  IREE_ASSERT_OK(iree_vm_list_push_ref_move(outputs.get(), &buffer_view_ref));
+
+  testing::TempFilePath path("function_io_padded_dense_buffer", ".bin");
+  ASSERT_TRUE(path);
+  std::string output_spec = "@" + path.path();
+  iree_string_view_t spec =
+      iree_make_string_view(output_spec.data(), output_spec.size());
+  iree_string_view_list_t specs = {1, &spec};
+  IREE_ASSERT_OK(iree_tooling_write_variants(
+      outputs.get(), specs, /*max_element_count=*/1024,
+      /*default_stream=*/NULL, host_allocator));
+  std::ifstream output(path.path(), std::ios::binary);
+  ASSERT_TRUE(output);
+  for (iree_host_size_t i = 0; i < shape[0]; ++i) {
+    EXPECT_EQ(contents[i], output.get());
+  }
+  EXPECT_EQ(std::char_traits<char>::eof(), output.get());
+}
+
+TEST_F(FunctionIOTest, WriteEmptyDenseBufferView) {
+  iree_hal_buffer_params_t buffer_params = {
+      /*.usage=*/IREE_HAL_BUFFER_USAGE_DEFAULT,
+      /*.access=*/IREE_HAL_MEMORY_ACCESS_ALL,
+      /*.type=*/IREE_HAL_MEMORY_TYPE_HOST_LOCAL,
+      /*.queue_affinity=*/0,
+  };
+  iree_hal_buffer_t* buffer = NULL;
+  IREE_ASSERT_OK(iree_hal_allocator_allocate_buffer(
+      device_allocator, buffer_params, /*allocation_size=*/1, &buffer));
+
+  const iree_hal_dim_t shape[] = {0};
+  iree_hal_buffer_view_t* buffer_view = NULL;
+  IREE_ASSERT_OK(iree_hal_buffer_view_create(
+      buffer, IREE_ARRAYSIZE(shape), shape, IREE_HAL_ELEMENT_TYPE_INT_8,
+      IREE_HAL_ENCODING_TYPE_DENSE_ROW_MAJOR, host_allocator, &buffer_view));
+  iree_hal_buffer_release(buffer);
+
+  vm::ref<iree_vm_list_t> outputs;
+  IREE_ASSERT_OK(iree_vm_list_create(iree_vm_make_undefined_type_def(), 1,
+                                     host_allocator, &outputs));
+  iree_vm_ref_t buffer_view_ref = iree_hal_buffer_view_move_ref(buffer_view);
+  IREE_ASSERT_OK(iree_vm_list_push_ref_move(outputs.get(), &buffer_view_ref));
+
+  testing::TempFilePath path("function_io_empty_dense_buffer", ".bin");
+  ASSERT_TRUE(path);
+  std::string output_spec = "@" + path.path();
+  iree_string_view_t spec =
+      iree_make_string_view(output_spec.data(), output_spec.size());
+  iree_string_view_list_t specs = {1, &spec};
+  IREE_ASSERT_OK(iree_tooling_write_variants(
+      outputs.get(), specs, /*max_element_count=*/1024,
+      /*default_stream=*/NULL, host_allocator));
+  std::ifstream output(path.path(), std::ios::binary);
+  ASSERT_TRUE(output);
+  EXPECT_EQ(std::char_traits<char>::eof(), output.get());
+}
+
 }  // namespace
 }  // namespace iree