caught by clang's -fsanitize=shift. A small unsigned int was
promoted, according to C's regular promotion rules, to a signed
int, it was then left shifted.  This sometimes pushed a 1 into
the sign bit, which is undefined behaviour. Fixed by using
unsigned temporaries.