nx_clmul_kat.nx

nx_clmul_kat.nx -- end-to-end proof of the PCLMULQDQ pipeline (assembler `pclmulqdq` mnemonic + compiler __clmul_ll/hh/lh/hl intrinsics). Carry-less (GF(2) polynomial) multiply has hand-checkable known answers: clmul(0x3,0x7) = (x+1)(x^2+x+1) = x^3+1 = 0x9 clmul(0xFF,0xFF) = carry-less square spreads bits 0..7 = 0x5555 clmul(x^63, x) = x^64 -> low=0, high=1 (spans the 128-bit result) The decoy halves prove each variant reads the RIGHT 64-bit half (l/h) of each operand. __clmul_XY(p,q) writes the 128-bit product back to *p in place; p[0]=low, p[1]=high. expect_exit: 0 (any nonzero = the check whose code it carries failed)