Not the already-padded length of u, which doesn't make any sense. Now
we actually calculate 96-bit products correctly using the `poly64'
multiplication machinery.
## straightforward except for the 96-bit case, where we end up with two
## short pieces which we pad at the beginning.
if uw%mulwd: pad = (-uw)%mulwd; u += C.ByteString.zero(pad); uw += pad
- if vw%mulwd: pad = (-uw)%mulwd; v += C.ByteString.zero(pad); vw += pad
+ if vw%mulwd: pad = (-vw)%mulwd; v += C.ByteString.zero(pad); vw += pad
uu = split_gf(u, mulwd)
vv = split_gf(v, mulwd)