[lacatoire]

The key length check reported argument 3 ($counter) instead of argument 4 ($key). The guard was copied from sodium_crypto_stream_xchacha20_xor(), where the key is argument 3.

$nonce = random_bytes(SODIUM_CRYPTO_STREAM_XCHACHA20_NONCEBYTES);
try {
  sodium_crypto_stream_xchacha20_xor_ic('message', $nonce, 0, 'short key');
} catch (Throwable $e) {
  echo $e::class, ': ', $e->getMessage(), "\n";
}

Before: Argument #3 ($counter) must be SODIUM_CRYPTO_STREAM_XCHACHA20_KEYBYTES bytes long
After: Argument #4 ($key) must be SODIUM_CRYPTO_STREAM_XCHACHA20_KEYBYTES bytes long