# X86-64: CMOV r32 zero-extension incorrectly depends on the condition

**URL:** <https://community.hex-rays.com/t/x86-64-cmov-r32-zero-extension-incorrectly-depends-on-the-condition/863>\
**Category:** Bugs\
**Created:** [November 2, 2026, 11:07pm UTC](https://community.hex-rays.com/t/x86-64-cmov-r32-zero-extension-incorrectly-depends-on-the-condition/863 "2026-11-02T23:07:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![QuietMaple10](https://avatars.discourse-cdn.com/v4/letter/q/50afbb/32.png) [@QuietMaple10](https://community.hex-rays.com/u/QuietMaple10)\
**Post date:** [November 2, 2026, 11:07pm UTC](https://community.hex-rays.com/t/x86-64-cmov-r32-zero-extension-incorrectly-depends-on-the-condition/863/1 "2026-11-02T23:07:07Z")

</div>

Given the following minimal example:

```x86asm
repro:
    xor ecx, ecx
    mov rax, 1122334455667788h
    mov rdx, 0BEEFh
    cmovo eax, edx
    ret

```

Since `xor ecx, ecx` clears OF, the conditional move is not taken.

At `MMAT_GENERATED`, the `CMOVO` is lowered into:

```plaintext
lnot of.1, tt.1 ; u=of.1 d=tt.1
jcnd tt.1, $locret_16 ; u=tt.1

```

With the following operations only on the conditionally executed path:

```plaintext
mov edx.4, eax.4 ; u=edx.4 d=eax.4
xdu eax.4, rax.8 ; u=eax.4 d=rax^4.4

```

At `MMAT_LVARS`:

```plaintext
mov #0x1122334455667788.8, rax.8 ; u= d=rax.8

```

Resulting in:

```c
return 0x1122334455667788LL;

```

However, in 64-bit mode, a 32-bit `CMOVcc` clears bits 63:32 of the destination register even when the condition is false.

The expected result is:

```auto
return 0x55667788;

```

The `xdu` operation is currently placed only on the path where the move occurs. The upper 32 bits should also be cleared when the condition is false, while preserving the original low 32 bits.