BNDSTX

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND4 to BND15
        fault(UD)
    la = dest.address            # where the pointer is
    w = 28                       # its bits 47 + MAWA to 20
    if CPL == 3:                 # pick the directory's entry
        r = cpuid_leaf(7, 0)
        w += r[2] >> 17 & 31     # MAWAU; MAWA is 0 below CPL 3
    i = la >> 20 & (1 << w) - 1
    bde = (cfg >> 12 << 12) + 8 * i
    if not canonical(bde):
        fault(GP, 0)
    bt = load(bde, 64)           # the entry: a table's address
    if not bt & 1:               # not valid: BNDSTATUS gets
        bound_fault(bde | 2)     # the entry's address, code 2
    i = la >> 3 & 0x1FFFF        # bits 19:3 pick the table's
    bte = (bt >> 3 << 3) + 32 * i  # entry, of 32 bytes
    if not canonical(bte):
        fault(GP, 0)
    b = bnd.read()
    store(bte, 64, low(b, 64))   # LB, UB as kept, and the
    store(bte + 8, 64, b >> 64)  # pointer's value
    store(bte + 16, 64, index_reg(dest))
# bytes 24 to 31 of the entry are reserved and stay; nothing is
# written at dest's address. The scale is ignored, and
# RIP-relative addressing is refused (#UD)

on = 0                           # CPUID: no MPX: a hint NOP
if cpuid_leaf(7, 0)[1] >> 14 & 1:
    cfg = bndcfgu if CPL == 3 else bndcfgs
    on = cr4 >> 18 & 1 and cfg & 1  # CR4.OSXSAVE, BNDCFGx.EN
if on and xcr0 >> 3 & 3 == 3:    # XCR0's BNDREGS, BNDCSR
    if bnd.number > 3:           # BND0 to BND3 only
        fault(UD)
    la = dest.address            # where the pointer is
    i = la >> 12 & 0xFFFFF       # bits 31:12 pick the entry
    bde = (low(cfg, 32) >> 12 << 12) + 4 * i
    bt = load(bde, 32)           # the entry: a table's address
    if not bt & 1:               # not valid: BNDSTATUS gets
        bound_fault(bde | 2)     # the entry's address, code 2
    i = la >> 2 & 0x3FF          # bits 11:2 pick the table's
    bte = (bt >> 2 << 2) + 16 * i  # entry, of 16 bytes
    b = bnd.read()
    store(bte, 32, low(b, 32))   # bits 31:0 of LB and UB, and
    store(bte + 4, 32, b >> 64)  # the pointer's value
    store(bte + 8, 32, index_reg(dest))
# bytes 12 to 15 of the entry are reserved and stay; the
# addresses are 32 bits and offsets into DS