lea hl, ix - 16     ; tmp in hl
                ld b, 16
                or a                ; reset carry
.loop_mul2:
                rl (hl)
                inc hl
                djnz .loop_mul2

                ; now xor with polynomial if tmp degree too high
                ; method below is constant-time

                sbc a, a
                and a, 10000111b
                xor a, (ix - 16)
                ld (ix - 16), a