diff --git a/src/dawn/native/CommandAllocator.h b/src/dawn/native/CommandAllocator.h
index 822998747ee..dee4a19a588 100644
--- a/src/dawn/native/CommandAllocator.h
+++ b/src/dawn/native/CommandAllocator.h
@@ -155,8 +155,13 @@ class CommandIterator : public NonCopyable {
     DAWN_FORCE_INLINE void* NextData(size_t dataSize, size_t dataAlignment) {
         uint32_t id = 0;
         bool hasId = NextCommandId(&id);
-        DAWN_ASSERT(hasId);
-        DAWN_ASSERT(id == detail::kAdditionalData);
+        // DAWN_CHECK (release-enforced): the producer/consumer command-stream
+        // contract requires a kAdditionalData marker here. A missing marker
+        // (e.g. AllocateData() returned nullptr under OOM and the caller did
+        // not propagate the error) would otherwise silently desync the
+        // iterator and lead to type confusion in FreeCommands.
+        DAWN_CHECK(hasId);
+        DAWN_CHECK(id == detail::kAdditionalData);
 
         return NextCommand(dataSize, dataAlignment);
     }