The AVX2-optimized implementation of SHAKE-256 intended for use in ML-KEM and ML-DSA would panic if the length of the output buffers was greater than 32 and not a multiple of 8, due to an out-of-bounds indexing operation.

This bug impacts users on AVX2 platforms that use the libcrux sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA with output buffers of length > 32 and not divisible by 8. It does not impact the use in ML-KEM or ML-DSA because there output buffer lengths are always divisible by 8.

Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no longer panic on output buffer lengths > 32 that are not divisible by 8.