FMA implementation subtly incorrect

[gnzlbg]

It appears that unsigned integer subtraction was mapped to Sub::sub(a, b) in Rust (a - b), instead of a.wrapping_sub(b). In C, unsigned integer subtraction wraps, but in rust, unless wrapping_sub is used, it panics on overflow in debug builds, and has UB in release builds.

[Lokathor]

It is not UB in release builds, it is wrapping in release builds.

[gnzlbg]

Indeed. So something else must be off as well, because it was producing segfaults for me in release.