BNDMK

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    a = src.address              # as LEA computes it; not read
    if not canonical(a):         # #SS(0) when the base register
        fault(GP, 0)             # is RSP or RBP
    ub = low(~a, 64)             # kept as its ones' complement
    bnd.write(ub << 64 | base_reg(src))
# the lower bound is the base register alone, 0 without one: BNDMK
# bnd0, [rax + rcx] makes the buffer RAX to RAX + RCX, ends
# included. RIP-relative addressing is refused (#UD). Outside
# 64-bit mode both bounds are 32 bits, zero-extended