// byteorder.BePutUint64(padlen[t+0:], 0)
	byteorder.BePutUint64(padlen[t+8:], len)
	d.Write(padlen)

	if d.nx != 0 {
		panic("d.nx != 0")
	}

	var digest [Size]byte
	byteorder.BePutUint64(digest[0:], d.h[0])
	byteorder.BePutUint64(digest[8:], d.h[1])
	byteorder.BePutUint64(digest[16:], d.h[2])
	byteorder.BePutUint64(digest[24:], d.h[3])

	// Fill up the buffer with an incrementing count.
	c.buffer = c.storage[:streamBufferSize]
	c0, c1 := c.ctr[0], c.ctr[1]
	for i := 0; i < streamBufferSize; i += 16 {
		byteorder.BePutUint64(c.buffer[i+0:], c0)
		byteorder.BePutUint64(c.buffer[i+8:], c1)

		// Increment in big endian: c0 is high, c1 is low.
		c1++
		if c1 == 0 {
			// add carry
			c0++
		}
	}
	c.ctr[0], c.ctr[1] = c0, c1

	}

	left = (left << 31) | (left >> 1)
	right = (right << 31) | (right >> 1)

	preOutput := (uint64(right) << 32) | uint64(left)
	byteorder.BePutUint64(dst, permuteFinalBlock(preOutput))
}

func (c *tripleDESCipher) Decrypt(dst, src []byte) {
	if len(src) < BlockSize {
		panic("crypto/des: input not full block")
	}
	if len(dst) < BlockSize {

	p.lo = seed2
}

// MarshalBinary implements the encoding.BinaryMarshaler interface.
func (p *PCG) MarshalBinary() ([]byte, error) {
	b := make([]byte, 20)
	copy(b, "pcg:")
	byteorder.BePutUint64(b[4:], p.hi)
	byteorder.BePutUint64(b[4+8:], p.lo)
	return b, nil
}

var errUnmarshalPCG = errors.New("invalid PCG encoding")

// UnmarshalBinary implements the encoding.BinaryUnmarshaler interface.

	return uint64(b[7]) | uint64(b[6])<<8 | uint64(b[5])<<16 | uint64(b[4])<<24 |
		uint64(b[3])<<32 | uint64(b[2])<<40 | uint64(b[1])<<48 | uint64(b[0])<<56
}

func BePutUint64(b []byte, v uint64) {
	_ = b[7] // early bounds check to guarantee safety of writes below
	b[0] = byte(v >> 56)
	b[1] = byte(v >> 48)
	b[2] = byte(v >> 40)
	b[3] = byte(v >> 32)
	b[4] = byte(v >> 24)

		copy(counter[:], nonce)
		counter[gcmBlockSize-1] = 1
	} else {
		var y gcmFieldElement
		g.update(&y, nonce)
		y.high ^= uint64(len(nonce)) * 8
		g.mul(&y)
		byteorder.BePutUint64(counter[:8], y.low)
		byteorder.BePutUint64(counter[8:], y.high)
	}
}

// auth calculates GHASH(ciphertext, additionalData), masks the result with
// tagMask and writes the result to out.

		h1 = byteorder.LeUint64(hle[:8])
		h2 = byteorder.LeUint64(hle[8:])
	} else {
		h1 = byteorder.BeUint64(hle[:8])
		h2 = byteorder.BeUint64(hle[8:])
	}
	byteorder.BePutUint64(hle[:8], h1)
	byteorder.BePutUint64(hle[8:], h2)
	gcmInit(&g.productTable, hle)

	return g, nil
}

func (g *gcmAsm) NonceSize() int {
	return g.nonceSize
}

func (g *gcmAsm) Overhead() int {
	return g.tagSize
}

    inlining_test.go:102: not in expected set, but also inlinable: "Addr.MarshalBinary"
    inlining_test.go:102: not in expected set, but also inlinable: "bePutUint64"
    inlining_test.go:102: not in expected set, but also inlinable: "mask6"
    inlining_test.go:102: not in expected set, but also inlinable: "AddrPort.isZero"

// IPv6 addresses with zones are returned without their zone (use the
// [Addr.Zone] method to get it).
// The ip zero value returns all zeroes.
func (ip Addr) As16() (a16 [16]byte) {
	byteorder.BePutUint64(a16[:8], ip.addr.hi)
	byteorder.BePutUint64(a16[8:], ip.addr.lo)
	return a16
}

// As4 returns an IPv4 or IPv4-in-IPv6 address in its 4-byte representation.
// If ip is the zero [Addr] or an IPv6 address, As4 panics.

}

// gcmLengths writes len0 || len1 as big-endian values to a 16-byte array.
func gcmLengths(len0, len1 uint64) [16]byte {
	v := [16]byte{}
	byteorder.BePutUint64(v[0:], len0)
	byteorder.BePutUint64(v[8:], len1)
	return v
}

// gcmHashKey represents the 16-byte hash key required by the GHASH algorithm.
type gcmHashKey [16]byte

type gcmAsm struct {
	block     *aesCipherAsm