== DF-3856: unchecked BIOS shift counts (C99 6.5.7p3 UB) ==

[pll case1] shift_byte=3 -> shift=24: and_mask=0x0fffffff (correct: byte lane 3 kept 0x0f)
[pll case1] shift_byte=4 -> shift=32: and_mask=0xffffff0f (UB! count taken mod 32 -> lane 0, not lane 3; expected 0x0fffffff)
[gpio mask] tmp=9 -> 1<<tmp = 0x00000200 (intended single bit)
[gpio mask] tmp=32 -> 1<<tmp = 0x00000001 (UB! mod-32 -> bit 0; on other arch/codegen: anything)
[gpio mask] tmp=200 -> 1<<tmp = 0x00000100 (UB! mod-32 -> bit 8)

all three sites feed these masks straight into WREG32_PLL / r100_pm_misc() RMW / GPIO set_masks with no range check.
harness exit=0